Kubernetes

Kubernetes Workload Discovery

Discover Deployments, StatefulSets, DaemonSets, Jobs, and CronJobs and ingest them as inventory findings for runtime and policy correlation.

Environment variables

WORKLOAD_DISCOVERY_ENABLED=true
WORKLOAD_DISCOVERY_KINDS=deployments,statefulsets,daemonsets,cronjobs,jobs
WORKLOAD_DISCOVERY_MAX_ITEMS=10000

Finding shape

  • Uses finding_type=behavioral_anomaly with severity=info.
  • Sets affected_resource.resource_type=k8s_workload.
  • Includes labels, annotations, replicas, and container images in source metadata.
  • Uses deterministic dedup keys so repeated scans upsert rather than duplicate.

Operational guidance

  • Start with defaults and trim kinds only if API-server pressure is a concern.
  • Correlate discovered workloads with native eBPF runtime and policy findings for context.
  • Keep RBAC scoped to read-only list/get on selected workload resources.
Kubernetes Workload Discovery