Implement a rule based alerting system in Kubescape to send notifications (Monitoring phase)

[matthyx]

Overview

Export enough data in Prometheus to allow using alert manager for sending alerts based on posture (vulnerabilities+configuration).

Problem

As a user of Kubescape I want to use Prometheus exporter to send alerts:

• I want to get alerts when a privileged container is created.
• I want to get notified when a new vulnerability is discovered on my workloads.
• etc...

We're not (yet) convinced Prometheus metrics are the best tool to trigger alerts:

• How to send an alert when a specific CVE appears?
• Try to avoid creating individual metrics for each and every CVE...

Solution

Alternatives

• CEL rules?
  • benefit: could be used in admissions too
  • drawback: need to write a rule engine
• Kyverno or other admission controller solution?
  • not sure it will work with our CRDs
  • might need a full object returned from the watch

Additional context

We're looking for someone or an organization that has this need, and could help define requirements and use cases for this feature.
This is not necessary code contributions, but rather ideas and descriptions in plain English.

[matthyx]

Let's create a design document to start working on this: https://docs.google.com/document/d/1mgmZYDzOiEqIcGR26SerLfK4jIdo8VRg6kLDG_C77uk/edit?usp=sharing