---
# SPDX-FileCopyrightText: the secureCodeBox authors
#
# SPDX-License-Identifier: Apache-2.0

title: "ADR-0015: Kubernetes As Orchestration Engine for Scans"
sidebar_label: "ADR-0015"
---

# ADR-0015: Kubernetes As Orchestration Engine for Scans

| <!-- -->       | <!-- -->                                                                                               |
| -------------- | ------------------------------------------------------------------------------------------------------ |
| **Status**:    | ACCEPTED                                                                                               |
| **Date**:      | 2022-09-13                                                                                             |
| **Author(s)**: | Jannik Hollenbach [jannick.hollenbach@iteratec.com](mailto:jannick.hollenbach@iteratec.com), Sven Strittmatter [sven.strittmatter@iteratec.com](mailto:Sven.Strittmatter@iteratec.com) |

:::info
This ADR should have been written prior to implementation. But we started documenting ADR later. This ADR has therefore been written retrospectively to record the decision made at that time.
:::

## Context

_secureCodeBox_ is merely an orchestration of various security scanners. [Kubernetes][k8s] is a platform to orchestrate resources. In first place designed to orchestrate data center resources, but [Kubernetes][k8s] extended its capabilities to define [custom resources][k8s-cr]. This opens the possibility to define own resource types which will be orchestrated. Since we run all the integrated security scanners in containers anyway – a _secureCodeBox_ scanner is merely a [Docker][docker] image with a CLI scanner tool installed – it seems to be a perfect match to define these _scanners_ as custom resources and let Kubernetes orchestrate them, instead of implementing this orchestration (with all the consequences) by our own.

## Decision

We decided to use [Kubernetes][k8s] as underlying orchestration platform to manage the scan processes.

## Consequences

- _secureCodeBox_ is hard coupled to [Kubernetes][k8s] and therefore can't be run w/o a cluster.
- We need to implement an own [operator][k8s-operator] with our business logic.
  - Therefore, we need to learn [Go].
- We loose the web UI from version 1 and users need to use `kubectl` on command line to interact with _secureCodeBox_.
- No backward compatibility to version 1 installations, nor an easy upgrade path.

[k8s]: https://kubernetes.io/
[k8s-cr]: https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/
[k8s-operator]: https://kubernetes.io/docs/concepts/extend-kubernetes/operator/
[docker]: https://www.docker.com/
[go-lang]: https://go.dev/
