Is it possible to scan images from sidecar-containers, if their (automatic) injection occurs at the pod-level?

[albertschwarzkopf]

Hi,

is it possible to scan images from sidecar-containers? E.g. if istio (as service mash) is running in K8s-Cluster and some workloads are running istio-proxy as sidecar-container. So they are not definded in Deployment, Statefulset, ect.

[danielpacak]

@albertschwarzkopf Is it a question whether Starboard will scan images added to Deployment (or any K8s workload) at admission control time, for example, by mutating webhook?

[albertschwarzkopf]

@danielpacak I know that in default starboard configuration this is not possible. But maybe I missed something.
And if not, maybe it would be a good idea for new feature.

[danielpacak]

Why it's not possible? AFAIK a sidecar container is like any other container and Starboard scans all containers of a given workload. Can you provide an example playbook that you think will not be scanned by Starboard in its default configuration?

[albertschwarzkopf]

In case of a service mash like Istio and automatic injection, sidecar containers are injected into to pod template.
So unlike manual injection, automatic injection occurs at the pod-level. You won’t see any change to the deployment itself.

[danielpacak]

That's interesting. If that's the case should be update the title of this discussion to describe this particular scenario?

[albertschwarzkopf]

Good idea. Done.