feat: implement pod-based scanning architecture #1

Merged

morten-olsen merged 2 commits from pod-runners into main

2025-12-12 20:55:09 +01:00

morten-olsen commented

2025-12-12 20:53:29 +01:00

(Migrated from github.com)

This major refactor moves from synchronous subprocess-based scanning to asynchronous pod-based scanning using Kubernetes Jobs.

Architecture Changes

Scanner jobs are now Kubernetes Jobs with TTLAfterFinished for automatic cleanup
Jobs have owner references for garbage collection when NucleiScan is deleted
Configurable concurrency limits, timeouts, and resource requirements

New Features

Dual-mode binary: --mode=controller (default) or --mode=scanner
Annotation-based configuration for Ingress/VirtualService resources
Operator-level configuration via environment variables
Startup recovery for orphaned scans after operator restart
Periodic cleanup of stuck jobs

New Files

DESIGN.md: Comprehensive architecture design document
internal/jobmanager/: Job Manager for creating/monitoring scanner jobs
internal/scanner/runner.go: Scanner mode implementation
internal/annotations/: Annotation parsing utilities
charts/nuclei-operator/templates/scanner-rbac.yaml: Scanner RBAC

API Changes

Added ScannerConfig struct for per-scan scanner configuration
Added JobReference struct for tracking scanner jobs
Added ScannerConfig field to NucleiScanSpec
Added JobRef and ScanStartTime fields to NucleiScanStatus

Supported Annotations

nuclei.homelab.mortenolsen.pro/enabled
nuclei.homelab.mortenolsen.pro/templates
nuclei.homelab.mortenolsen.pro/severity
nuclei.homelab.mortenolsen.pro/schedule
nuclei.homelab.mortenolsen.pro/timeout
nuclei.homelab.mortenolsen.pro/scanner-image

RBAC Updates

Added Job and Pod permissions for operator
Created separate scanner service account with minimal permissions

Documentation

Updated README, user-guide, api.md, and Helm chart README
Added example annotated Ingress resources

This major refactor moves from synchronous subprocess-based scanning to asynchronous pod-based scanning using Kubernetes Jobs. ## Architecture Changes - Scanner jobs are now Kubernetes Jobs with TTLAfterFinished for automatic cleanup - Jobs have owner references for garbage collection when NucleiScan is deleted - Configurable concurrency limits, timeouts, and resource requirements ## New Features - Dual-mode binary: --mode=controller (default) or --mode=scanner - Annotation-based configuration for Ingress/VirtualService resources - Operator-level configuration via environment variables - Startup recovery for orphaned scans after operator restart - Periodic cleanup of stuck jobs ## New Files - DESIGN.md: Comprehensive architecture design document - internal/jobmanager/: Job Manager for creating/monitoring scanner jobs - internal/scanner/runner.go: Scanner mode implementation - internal/annotations/: Annotation parsing utilities - charts/nuclei-operator/templates/scanner-rbac.yaml: Scanner RBAC ## API Changes - Added ScannerConfig struct for per-scan scanner configuration - Added JobReference struct for tracking scanner jobs - Added ScannerConfig field to NucleiScanSpec - Added JobRef and ScanStartTime fields to NucleiScanStatus ## Supported Annotations - nuclei.homelab.mortenolsen.pro/enabled - nuclei.homelab.mortenolsen.pro/templates - nuclei.homelab.mortenolsen.pro/severity - nuclei.homelab.mortenolsen.pro/schedule - nuclei.homelab.mortenolsen.pro/timeout - nuclei.homelab.mortenolsen.pro/scanner-image ## RBAC Updates - Added Job and Pod permissions for operator - Created separate scanner service account with minimal permissions ## Documentation - Updated README, user-guide, api.md, and Helm chart README - Added example annotated Ingress resources