Unable to Run Scheduled scans

[AdonisOkpidi]

Overview

The kubescapeScheduler and kubevulnScheduler are not enabled and so the cronjobs for scheduled scanning are not created including the configmaps, cronjobs and networkpolicy.

Environment

• OS: Windows
• Kubescape Version: v3.0.18

Steps To Reproduce

• In the values.yaml under capabilities, ensure vulnerabilityScan and configurationScan are set to enabled.
• Install the kubescape operator from helm-chart repo with custom values.yaml file.
• By default the related configmap, cronjobs and network policies are not created defined here - https://github.com/kubescape/helm-charts/tree/main/charts/kubescape-operator/templates/kubevuln-scheduler and https://github.com/kubescape/helm-charts/tree/main/charts/kubescape-operator/templates/kubescape-scheduler.
• Looking at the following line for example

  helm-charts/charts/kubescape-operator/templates/kubescape-scheduler/cronjob.yaml

  Line 5 in f085cc3

  {{- if $components.kubescapeScheduler.enabled }}

  .
• Looked in the components definition and seems the condition for kubescapeScheduler has to be met enabled as shown in the line 54 below

  helm-charts/charts/kubescape-operator/templates/_common.tpl

  Lines 47 to 58 in f085cc3

  	{{- define "components" -}}
  	{{- $configurations := fromYaml (include "configurations" .) }}
  	hostScanner:
  	enabled: {{ eq .Values.capabilities.nodeScan "enable" }}
  	kubescape:
  	enabled: {{ eq .Values.capabilities.configurationScan "enable" }}
  	kubescapeScheduler:
  	enabled: {{ and $configurations.submit (eq .Values.capabilities.configurationScan "enable") }}
  	kubevuln:
  	enabled: {{ eq .Values.capabilities.vulnerabilityScan "enable" }}
  	kubevulnScheduler:
  	enabled: {{ and $configurations.submit (eq .Values.capabilities.vulnerabilityScan "enable") }}

• In the configuration definition{{- $submit := not (empty .Values.server) -}} does not allow for empty server value which means the value would never be true and hence why the cronjobs and configmaps are not created.

Expected behavior

configmaps, cronjobs and networkpolicies enabled for scheduled scanning to be possible.

[matthyx]

@AdonisOkpidi we have 2 competing scan options: scheduled scans and continuous scanning.
If you have continuous scanning enabled, you cannot have scheduled scans.

[AdonisOkpidi]

@matthyx We would like the scheduled scan option too as it’s a requirement. If we had a license, would we be able to have both scans enabled at the same time?

[matthyx]

@matthyx We would like the scheduled scan option too as it’s a requirement. If we had a license, would we be able to have both scans enabled at the same time?

yes, this is a technical limitation we don't have with the platform because we don't rely on continuous scans
(we still plan to finish continuous scanning this year, I'm just short on time to get it all done)

[AdonisOkpidi]

@matthyx We would like the scheduled scan option too as it’s a requirement. If we had a license, would we be able to have both scans enabled at the same time?

yes, this is a technical limitation we don't have with the platform because we don't rely on continuous scans (we still plan to finish continuous scanning this year, I'm just short on time to get it all done)

What do you mean by 'finish continuous scanning this year' Does this mean continuous scanning would be able to run scans on a scheduled basis?

Also would it be possible to trigger a rescan without relying on kubescape scheduler??