Glossary

A cluster with no connection to the internet. To scan in such a cluster, you mirror the vulnerability databases and the VEX Hub repositories to servers inside the cluster network.

A field of the WorkloadScanConfiguration. It names one namespace that holds the managed resources for all workloads. If the field is empty, each workload namespace holds its own managed resources. The WorkloadScanReport always stays in the workload namespace.

The list of repositories in a registry. The catalogType field of a Registry tells the scanner how to get this list. The default reads the _catalog endpoint of the registry. The NoCatalog value is for registries that do not expose this endpoint. With NoCatalog, you list the repositories in the Registry resource.

Common Expression Language. The language of the expressions in a match condition. The Kubernetes API uses CEL for validation rules.

A Kubernetes operator for PostgreSQL. Also written CNPG. The Helm chart uses it by default to run the database of the storage component. You can use an external PostgreSQL instance instead.

The component that reconciles the custom resources. It creates scheduled ScanJob and NodeScanJob resources, serves the admission webhooks, and runs the workload scan and node scan features.

Common Vulnerabilities and Exposures. The public identifier of a vulnerability, for example CVE-2024-1234. Each entry in a VulnerabilityReport has a CVE identifier.

Common Vulnerability Scoring System. A number from 0 to 10 that rates the severity of a vulnerability. A VulnerabilityReport records the CVSS score and vector from each vendor that published one.

The SHA256 hash that identifies one image manifest. Two tags that point to the same digest are the same image. Images with the same digest share one SBOM. The indexDigest field holds the digest of the multi-platform index that referenced the image.

A record of one container image that the scanner discovered. It holds the image metadata, the image layers, and the list of workloads that use the image. Namespaced. The scanner creates it. One multi-platform image produces one Image resource per platform.

A resource that the workload scan feature creates and owns. This includes the Registry, ScanJob, Image, SBOM, and VulnerabilityReport resources for the images of a workload. Managed resources carry the label sbomscanner.kubewarden.io/workloadscan: "true". Webhooks reject changes from users.

A named CEL expression on a repository of a Registry. It selects the image tags to scan. The matchOperator field combines several conditions with And or Or. A ScanJob can refer to a match condition by name to scan a subset of tags.

An optional component that speaks the Model Context Protocol. It lets an AI assistant query vulnerability data and manage scan resources. It is experimental.

The message broker between the controller and the workers. The Helm chart deploys it as a StatefulSet.

The SBOM of the file system of one node, in SPDX format. Cluster-scoped. The node worker creates it.

The resource that enables node scanning. It holds the node selector, the scan interval, the skip patterns, and the platform filter. Cluster-scoped. One instance, named default. You create it. Without it, no node is scanned.

A request to scan one node. Cluster-scoped. The controller creates it on the scan interval or after a rescan annotation. You can create one for a scan on demand.

The vulnerability scan result for one node. It has the same report structure as a VulnerabilityReport. Cluster-scoped. The node worker creates it.

Open Container Initiative. The standards for container images, registries, and artifacts. The scanner catalogs OCI images only. It skips other OCI artifacts, for example signatures, attestations, and Helm charts.

The framework that the scanner uses to export traces and metrics. The export uses the OTLP protocol over gRPC. It is off until you set a collector endpoint.

A list of operating system, architecture, and variant entries. It limits the scan to the platforms that you run. Without a filter, the scanner scans all platforms of a multi-platform image. The platforms field exists on the Registry, the WorkloadScanConfiguration, and the NodeScanConfiguration.

A registry that needs credentials. You store the credentials in a kubernetes.io/dockerconfigjson Secret and refer to it in the authSecret field of the Registry. The caBundle field adds a private certificate authority.

Package URL. A string that identifies one package in one ecosystem, for example pkg:deb/debian/openssl@3.0.11. Each vulnerability in a VulnerabilityReport names the PURL of the affected package.

The resource that describes a container registry to scan. It holds the URI, the catalog type, the repositories and match conditions, the credentials, the platform filter, and the scan interval. Namespaced. You create it. The workload scan feature also creates managed Registry resources. If you delete a Registry, the scanner deletes its images, SBOMs, reports, and scan jobs.

The annotation sbomscanner.kubewarden.io/node-rescan-requested: "true" on the NodeScanConfiguration. It starts a scan of all matching nodes at once, without a wait for the scan interval. The controller removes the annotation after it creates the NodeScanJob resources.

Software Bill of Materials. The list of packages in an image or on a node. The scanner generates one SPDX document per image and stores it in an SBOM resource. Namespaced. The worker creates it. When the vulnerability database changes, the scanner reads the stored SBOM again. It does not pull the image again.

A duration that turns on scheduled scans. The scanInterval field exists on the Registry, the WorkloadScanConfiguration, and the NodeScanConfiguration. If the field is not set, the scanner does not scan on a schedule. You then create a ScanJob or a NodeScanJob by hand.

A request to scan one Registry. It works like a Kubernetes Job. Its status conditions report the stages: scheduled, in progress, complete, or failed. Namespaced, in the namespace of the Registry. You create it for a scan on demand. The controller creates it on the scan interval.

System Package Data Exchange. The document format of each SBOM and NodeSBOM. The scanner stores SPDX as JSON.

A Kubernetes extension API server. It serves the storage.sbomscanner.kubewarden.io API group: Image, SBOM, VulnerabilityReport, WorkloadScanReport, NodeSBOM, and NodeVulnerabilityReport. It stores these resources in PostgreSQL instead of etcd.

A vulnerability that a VEX statement marks as not applicable. The report keeps the entry with suppressed: true and the VEX status. The severity counts in the report summary do not include suppressed vulnerabilities.

The annotation sbomscanner.kubewarden.io/traceparent on a ScanJob or NodeScanJob. It carries a W3C trace context. A client that already has a trace, for example a CI pipeline, sets it so that the scan becomes part of that trace.

The scanner engine inside the worker. It generates the SBOM and matches it against the vulnerability database.

Vulnerability Exploitability eXchange. A document in which a software vendor states whether a CVE affects a product. The scanner applies VEX statements during a scan and marks the matched entries as suppressed.

A repository that collects VEX documents from many projects. The scanner reads the repositories that you configure with VEXHub resources.

The resource that points at one VEX Hub repository. It holds the URL and an enabled flag. The scanner applies all enabled VEXHub resources to every scan. Cluster-scoped. You create it. The Helm chart creates two by default, for the Rancher and the Aqua Security repositories.

The data that Trivy matches an SBOM against. The worker pulls two OCI artifacts: the main database and the Java database. In an air-gapped cluster, you mirror both to an internal registry.

The scan result for one Image on one platform. It holds a summary with the count per severity, and the list of vulnerabilities per target. Each vulnerability names the CVE, the package and its PURL, the installed and fixed versions, the layer, the severity, and the CVSS scores. Namespaced. The worker creates it.

The component that does the scan work. It reads scan messages from NATS, catalogs the registry, generates the SBOM, and scans it with Trivy. For node scans, a worker runs on each node as a DaemonSet and reads the host file system.

The top-level owner of a Pod. The workload scan feature follows the owner references of a Pod up to the Deployment, StatefulSet, DaemonSet, Job, or CronJob. It creates one WorkloadScanReport per workload.

The resource that enables workload scanning. It holds the namespace selector, the artifactsNamespace, the scan interval, the credentials, and the platform filter. Cluster-scoped. One instance, named default. You create it.

The vulnerability view of one workload. It lists the containers of the workload, their images, and the vulnerabilities of each image. It has one summary for the whole workload. Namespaced, in the namespace of the workload. The controller creates it. Users cannot change it.