Skip to content

fix(watcher): learn workloads from pods even without a backend #485

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
matthyx merged 1 commit into from
Nov 10, 2026
Merged

fix(watcher): learn workloads from pods even without a backend #485

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 5 additions & 9 deletions watcher/sbomwatcher.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,16 +48,12 @@ func (wh *WatchHandler) SBOMWatch(ctx context.Context, workerPool *ants.PoolWith
FieldSelector: "status.phase=Running", // only when the pod is running
}

// we only need pods if we have a backend
if wh.cfg.Components().ServiceDiscovery.Enabled {
// list pods and add them to the queue, this is for the pods that were created before the watch started
err := wh.listPods(ctx)
if err != nil {
logger.L().Error("failed to list existing pods", helpers.Error(err))
}
// start watching pods
go wh.watchRetry(ctx, watchOpts)
// list pods and add them to the queue, this is for the pods that were created before the watch started
if err := wh.listPods(ctx); err != nil {
logger.L().Error("failed to list existing pods", helpers.Error(err))
}
// start watching pods
go wh.watchRetry(ctx, watchOpts)

// start watching SBOMs
go wh.HandleSBOMEvents(eventQueue, cmdCh, errorCh)
Expand Down
31 changes: 31 additions & 0 deletions watcher/sbomwatcher_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,9 @@ import (
"github.com/kubescape/operator/utils"
spdxv1beta1 "github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1"
kssfake "github.com/kubescape/storage/pkg/generated/clientset/versioned/fake"
"github.com/panjf2000/ants/v2"
"github.com/stretchr/testify/assert"
corev1 "k8s.io/api/core/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/runtime"
"k8s.io/apimachinery/pkg/watch"
Expand Down Expand Up @@ -421,3 +423,32 @@ func TestHandleSBOMEvents_WlidNeverArrives_ExhaustsRetries(t *testing.T) {
_, exists := wh.sbomRetryAttempts.Load(key)
assert.False(t, exists, "retry counter must be cleared on exhaustion")
}

// TestSBOMWatch_LearnsWorkloadsWithoutBackend covers a cluster with no backend, where the
// chart leaves ServiceDiscovery disabled. HandleSBOMEvents drops any SBOM whose Wlid it
// cannot find, and only pod events supply that Wlid, so the pods must be watched there too.
func TestSBOMWatch_LearnsWorkloadsWithoutBackend(t *testing.T) {
wh := newTestHandler(t)
assert.False(t, wh.cfg.Components().ServiceDiscovery.Enabled)
wh.eventQueue = NewCooldownQueueWithParams(50*time.Millisecond, 10*time.Millisecond)

pod := &corev1.Pod{
ObjectMeta: metav1.ObjectMeta{Name: "nginx", Namespace: "default"},
Status: corev1.PodStatus{
Phase: corev1.PodRunning,
ContainerStatuses: []corev1.ContainerStatus{{Name: testContainerName, ImageID: testImageID}},
},
}
_, err := wh.k8sAPI.KubernetesClient.CoreV1().Pods(pod.Namespace).Create(context.Background(), pod, metav1.CreateOptions{})
assert.NoError(t, err)

pool, err := ants.NewPoolWithFunc(1, func(interface{}) {})
assert.NoError(t, err)
defer pool.Release()

go wh.SBOMWatch(context.Background(), pool)

assert.Eventuallyf(t, func() bool {
return wh.ImageToContainerData.Get(testImageHashOnly).Wlid != ""
}, 3*time.Second, 20*time.Millisecond, "the Wlid of image %s was never learned from its pod", testImageHashOnly)
}
Loading