How Ctadel accesses the cluster
The cluster is discovered during the project inventory. Ctadel requests the kubeconfig from the Kapsule API with the connected application key. A kubeconfig provided in the application takes precedence.
Kubernetes
Scaleway Kapsule
Your Kapsule clusters are discovered from the connected Scaleway project and read through their API, with no agent in the cluster.
What is read
Workloads, service accounts, RBAC, network policies, secrets and configmaps, nodes and images. Running images are analysed for vulnerabilities. The cluster enters the same graph as the cloud account hosting it: a privileged pod on a node reachable from the internet becomes a link of an attack path.
- Privileged container or container running as root
- API server exposed without address restriction
- Service account with a cluster-admin role
- Running image with a known exploited vulnerability
See it on your accounts
The online demonstration is open to all, on fictitious data. For an instance on your own accounts, request a demonstration.