Security

The page to attach to your security review. Everything Kubesonar does with your data, in one place.

Data flow

Destination	What	When
Your Kubernetes API servers	API requests with your kubeconfig credentials (read; write only for actions you trigger: apply, scale, restart, delete, exec, port-forward)	While connected
Licensing API (merchant of record)	License key, random instance id, hostname	On activation, then about once a day; 14-day offline grace
Anywhere else	Nothing. No telemetry, no crash reports, no analytics.	—

Kubernetes permissions

Navigation needs get, list and watch on the resources you want to see. Observed traffic (L7 and L4) reads Istio's Envoy sidecar metrics through pods/proxy (verb get); without Istio there is no live traffic view. Write actions need the corresponding verbs and are never performed without a click. The role below is enough for every network feature.

# read-only role: every network feature works with this
rules:
- apiGroups: ["", "apps", "networking.k8s.io", "discovery.k8s.io"]
  resources: ["networkpolicies", "pods", "namespaces", "nodes", "services", "endpointslices", "deployments", "statefulsets", "daemonsets"]
  verbs: ["get", "list", "watch"]
- apiGroups: [""]
  resources: ["events"]
  verbs: ["list", "watch"]
# observed traffic (Istio sidecars), optional
- apiGroups: [""]
  resources: ["pods/proxy"]
  verbs: ["get"]
# RBAC, CRD and Istio views, optional
- apiGroups: ["rbac.authorization.k8s.io", "apiextensions.k8s.io", "networking.istio.io"]
  resources: ["*"]
  verbs: ["get", "list"]

Network

Live L7/L4 topology scrapes each sidecar's metrics endpoint (port 15090) through the API server proxy. On clusters with strict NetworkPolicies (for example managed clusters that route pods/proxy through a tunnel) you may need a policy allowing ingress to 15090 from the API server. Nothing is installed in the cluster. This is the policy:

# Allow the API server (via its tunnel agent, e.g. konnectivity on AKS) to scrape
# each Istio sidecar's Envoy port 15090. Apply in every namespace you want to observe.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-apiserver-envoy-metrics
spec:
  podSelector: {}
  policyTypes: [Ingress]
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system
      podSelector:
        matchLabels:
          app: konnectivity-agent
    ports:
    - port: 15090
      protocol: TCP

Credentials on your Mac

Kubeconfig files are read in place and never copied. License data lives in the macOS Keychain. The app is sandboxed; its daemon runs as your user and listens only on localhost.

Verify the download

Every release is signed with our Apple Developer ID and notarized by Apple. After mounting the DMG:

codesign --verify --deep --strict --verbose=2 /Volumes/Kubesonar/Kubesonar.app
spctl --assess --type execute --verbose /Volumes/Kubesonar/Kubesonar.app
# expect: accepted · source=Notarized Developer ID

Reporting a vulnerability

Write to security@kubesonar.com. We acknowledge within two business days and credit reporters in the changelog if they wish.