feat: support the Continuous Scanning capability

[vladklokun]

PR Type:

Enhancement

---

PR Description:

This PR introduces the Continuous Scanning feature in Kubescape, a tool for Kubernetes security. The main changes include:

• Enabling Continuous Scanning in the Kubescape Operator Helm chart.
• Providing detailed documentation on how to use the Continuous Scanning feature.
• Adding a new ConfigMap for matching rules related to continuous scanning.
• Modifying the operator deployment to include the new ConfigMap.
• Updating the values.yaml file to include configurations for continuous scanning.

Once kubescape/storage#59 and kubescape/operator#174 are merged, we can use our proper Quay images.

---

PR Main Files Walkthrough:

files:

charts/kubescape-operator/README.md: Added extensive documentation on the Continuous Scanning feature, including its installation, accessing results, and how it works.
charts/kubescape-operator/templates/configs/matchingRules-configmap.yaml: Introduced a new ConfigMap for matching rules related to continuous scanning.
charts/kubescape-operator/templates/operator/deployment.yaml: Updated the operator deployment to include the new ConfigMap for continuous scanning.
charts/kubescape-operator/values.yaml: Added new configurations for the continuous scanning feature, including the ConfigMap name and matching rules. Also updated the operator image repository and tag.

---

User Description:

Overview

This PR adds support for Continuous Scanning. It exposes new values
that control:

• whether to enable Continuous Scanning
• which resources to monitor.

I left some docs in the README before we merge kubescape/kubescape.io#25. But after we merge it, I will remove the docs from the README and provide the links to the new documentation.

[codiumai-pr-agent-free]

PR Analysis

• 🎯 Main theme: Adding Continuous Scanning feature to Kubescape
• 📝 PR summary: This PR introduces the Continuous Scanning feature in Kubescape, a tool for Kubernetes security. The main changes include enabling Continuous Scanning in the Kubescape Operator Helm chart, providing detailed documentation on how to use the Continuous Scanning feature, adding a new ConfigMap for matching rules related to continuous scanning, modifying the operator deployment to include the new ConfigMap, and updating the values.yaml file to include configurations for continuous scanning.
• 📌 Type of PR: Enhancement
• 🧪 Relevant tests added: No
• ⏱️ Estimated effort to review [1-5]: 3, because the PR introduces a new feature and modifies several files, but the changes are well-documented and straightforward.
• 🔒 Security concerns: No security concerns found

PR Feedback

• 💡 General suggestions: The PR is well-structured and the changes are well-documented. However, it would be beneficial to include tests for the new feature to ensure its functionality and prevent future regressions.

• 🤖 Code feedback:

  • relevant file: charts/kubescape-operator/values.yaml
    suggestion: Consider parameterizing the image repository and tag for the continuous scanning feature, similar to how it's done for the operator image. This would make it easier to update or change the image in the future. [medium]
    relevant line: repository: vklokun/ks-operator-test

  • relevant file: charts/kubescape-operator/templates/operator/deployment.yaml
    suggestion: Ensure that the ConfigMap for continuous scanning is only mounted if the feature is enabled. This could be done by wrapping the relevant lines in a conditional block that checks the value of .Values.continuousScanning. [important]
    relevant line: - name: {{ .Values.continuousScanning.configMapName }}

  • relevant file: charts/kubescape-operator/values.yaml
    suggestion: It would be beneficial to provide a way for users to specify the namespaces to monitor in the continuous scanning feature, instead of hardcoding it to the 'default' namespace. [medium]
    relevant line: namespaces:

How to use

To invoke the PR-Agent, add a comment using one of the following commands:
/review [-i]: Request a review of your Pull Request. For an incremental review, which only considers changes since the last review, include the '-i' option.
/describe: Modify the PR title and description based on the contents of the PR.
/improve [--extended]: Suggest improvements to the code in the PR. Extended mode employs several calls, and provides a more thorough feedback.
/ask <QUESTION>: Pose a question about the PR.
/update_changelog: Update the changelog based on the PR's contents.

To edit any configuration parameter from configuration.toml, add --config_path=new_value
For example: /review --pr_reviewer.extra_instructions="focus on the file: ..."
To list the possible configuration parameters, use the /config command.

[dwertent]

Looking good.
I will approve after we change the images to the official released images

[vladklokun]

I apologize, I re-requested review for the wrong PR 🤦‍♂️

[Daniel-GrunbergerCA]

Suggested change

	Continuous Scanning is built into the Kubescape Operator Helm chart. To use this capibility, you only need to enable it. Start by navigating to the `values.yaml` file and make sure that the corresponding `capabilities.continuousScan` key is set to `enabled`, like so:
	Continuous Scanning is built into the Kubescape Operator Helm chart. To use this capability, you only need to enable it. Start by navigating to the `values.yaml` file and make sure that the corresponding `capabilities.continuousScan` key is set to `enabled`, like so:

[vladklokun]

Thank you for noticing! Fixed in latest.

[dwertent]

@vladklokun I'm not sure why this should be in the values file.
We don't want users to change it...

[vladklokun]

I added this to the values.yaml file so that we can change the monitored GVRs more conveniently. I wouldn’t overestimate how often people change the deeply-buried configurables in Helm charts.