Overview
Currently the Prometheus Exporter only provides metrics on a cluster and namespace level. We find it useful to also have an overview on a workload level which gives the possibility to know which exact Deployment has the most vulnerabilities or define custom alerts.
According to the existing metrics name pattern a new suffix is introduced for Vulnerabilities and ConfigurationScans like:
kubescape_controls_total_workload_<severity>kubescape_vulnerabilities_total_workload_<severity>kubescape_vulnerabilities_relevant_workload_<severity>
Additional Information
Initial discussion started here:
https://cloud-native.slack.com/archives/C04GY6H082K/p1733500846063089
How to Test
- run tests
- start Prometheus Exporter and open http://localhost:8080/metrics
Examples/Screenshots
This is how the metrics are exported via /metrics endpoint. Note the value is a dummy.
kubescape_controls_total_workload_medium{namespace="monitoring",workload="promtail",workload_kind="serviceaccount"} 1
kubescape_vulnerabilities_total_workload_critical{namespace="monitoring",workload="promtail",workload_kind="daemonset"} 2
kubescape_vulnerabilities_relevant_workload_medium{namespace="monitoring",workload="promtail",workload_kind="daemonset"} 3