Red Hat Advanced Cluster Security for Kubernetes architecture

Central requests the Indexer to download and index (analyze) given images. This process results in an index report. Scanner V4 Indexer requests mapping files from Central that assist the indexing process.

Central requests that the Scanner V4 Matcher match given images to known vulnerabilities. This process results in the final scan result: a vulnerability report. Scanner V4 Matcher requests the latest vulnerabilities from Central.

SecuredCluster scanning is enabled by default in Red Hat OpenShift environments deployed by using the Operator or when delegated scanning is used. When SecuredCluster scanning is enabled, Sensor requests Scanner V4 to index images. Scanner V4 Indexer requests mapping files from Sensor that assist the indexing process unless Central exists in the same namespace. In that case, Central is contacted instead.

The Indexer pulls image metadata from registries to determine the layers of the image, and downloads each previously unindexed layer.

Scanner V4 Matcher requests the results of the image indexing, the index report, from the Indexer. It then uses the report to determine relevant vulnerabilities. This interaction occurs only when the image is indexed in the Central cluster. This interaction does not occur when Scanner V4 is matching vulnerabilities for images indexed in secured clusters.

The Indexer stores data related to the indexing results to ensure that image layers are only downloaded and indexed once. This prevents unnecessary network traffic and other resource utilization.

Scanner V4 Matcher stores all of its vulnerability data in the database and periodically updates this data. Scanner V4 indexer also queries this data as part of the vulnerability matching process.

There is bidirectional communication between Central and Sensor. Sensor polls Central periodically to download updates for the sensor bundle configuration. It also sends events for the observed activity for the secured cluster and observed policy violations. Central communicates with Sensor to force reprocessing of all deployments against enabled policies.

Collector communicates with Sensor and sends all of the events to the respective Sensor for the cluster. On supported OpenShift Container Platform clusters, Collector analyzes the software packages installed on the nodes and sends them to Sensor so that Scanner can later scan them for vulnerabilities. Collector also requests missing drivers from Sensor. Sensor requests compliance scan results from Collector. Additionally, Sensor receives external Classless Inter-Domain Routing information from Central and pushes it to Collector.

Sensors send the list of security policies to enforce to Admission controller. Admission controller sends security policy violation alerts to Sensor. Admission controller can also request image scans from Sensor when required.

It is not common; however, Admission controller can communicate with Central directly if the Central endpoint is known and Sensor is unavailable.

There is bidirectional communication between Central and Scanner. Central requests image scans from Scanner, and Scanner requests updates to its CVE database from Central.

Central connects to the definitions.stackrox.io endpoint to receive the aggregated vulnerability information.

Central downloads supported kernel modules from collector-modules.stackrox.io.

Central queries the image registries to get image metadata. For example, to show Dockerfile instructions in the RHACS portal.

Scanner pulls images from the image registry to identify vulnerabilities.

There is bidirectional communication between Central and Sensor. Sensor polls Central periodically for downloading updates for the sensor bundle configuration. It also sends events for the observed activity for the secured cluster and observed policy violations. Central communicates with Sensor to force reprocessing of all deployments against enabled policies.

Sensor can communicate with the lightweight Scanner installed in the secured cluster. This connection allows Sensor to access registries directly from the secured cluster in scenarios where Central might be unable to access them. Scanner requests updated data from Sensor, Sensor forwards these requests to Central, and Central downloads the requested data from definitions.stackrox.io.

Collector communicates with Sensor and sends all of the events to the respective Sensor for the cluster. On supported OpenShift Container Platform clusters, Collector analyzes the software packages installed on the nodes and sends them to Sensor so that Scanner can later scan them for vulnerabilities. Collector also requests missing drivers from Sensor. Sensor requests compliance scan results from Collector. Additionally, Sensor receives external Classless Inter-Domain Routing information from Central and pushes it to Collector.

Sensors send the list of security policies to enforce to Admission controller. Admission controller sends security policy violation alerts to Sensor. Admission controller can also request image scans from Sensor when required.

It is not common; however, Admission controller can communicate with Central directly if the Central endpoint is known and Sensor is unavailable.

Central and Scanner V4 Indexer

gRPC

8443

Central and Sensor on secured cluster

443

Sensor and Central primarily communicate over a bidirectional gRPC stream, initiated by Sensor to Central’s port 443.

Central and user (CLI)

443

For more information about the --force-http1 option, see the roxctl command options.

Central and vulnerability feeds

HTTPS

443

Connects to definitions.stackrox.io by default.

Collector to Sensor

gRPC

443

This is a bidirectional gRPC connection initiated by Collector to Sensor’s port 443.

Collector (Compliance) to Sensor

gRPC

8444

If node scanning is enabled on OpenShift Container Platform release 4, this connection is initiated by Sensor to compliance running in the Collector pod.

Scanner to Scanner-DB

TCP

5432

Scanner V4 Indexer to Central

HTTPS

443

Scanner V4 Indexer and Matcher to Scanner V4 DB

TCP

5432

Sensor and Admission Controller

gRPC

443

This is a bidirectional gRPC stream, initiated by Admission Controller to Sensor’s port 443. This occurs in delegated scanning scenarios or in OpenShift Container Platform secured clusters.