skills.rest
rbudiharso
rbudiharsoCOMMUNITY
Explore all skills by this author →
Website𝕏@rbudiharsoGitHub

kubernetes-sbom-inventory

Generate SBOM and image inventory from Kubernetes cluster workloads using syft.

2|Updated Oct 20, 2017
Search Tags:#security#compliance#kubernetes#sbom#ecr#syft#image inventory
One-click install
npx skills add https://github.com/rbudiharso/dotfiles --skill kubernetes-sbom-inventory-rbudiharso
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: kubernetes-sbom-inventory
Source: https://github.com/rbudiharso/dotfiles/tree/main/hermes/.hermes/skills/devops/kubernetes-sbom-inventory
Command: npx skills add https://github.com/rbudiharso/dotfiles --skill kubernetes-sbom-inventory-rbudiharso

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Security and compliance teams need a complete Software Bill of Materials of every container image running in a Kubernetes cluster, but manually enumerating workloads, filtering platform add-ons, and scanning hundreds of images is slow and error-prone. ## Core Features & Use Cases - Workload Enumeration: Extracts container and initContainer images from Deployments, StatefulSets, DaemonSets, Jobs, and CronJobs across all namespaces, with filtering of kube-* namespaces and EKS add-on images. - Batch Syft Scanning: Scans each unique image with syft via background processes and parallel batches, with ECR authentication handling and per-image timeout control. - Aggregated Reporting: Produces image inventory CSV, per-package SBOM CSV, unique-package summary, CycloneDX 1.5 JSON, and a Markdown report including failed and stale images. - Use Case: Run a full-cluster audit on a production EKS cluster with 297 images to identify :latest tags, stale cross-region ECR references, and all 23,000+ unique packages for a compliance review. ## Quick Start Generate a full SBOM and image inventory of all workloads running in my Kubernetes cluster, excluding kube-system and EKS add-ons.

Frequently Asked Questions about kubernetes-sbom-inventory

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I generate an SBOM for all images in a Kubernetes cluster?▼

Enumerate images from Deployments, StatefulSets, DaemonSets, Jobs, and CronJobs with kubectl, deduplicate them, then scan each with syft in batches. Aggregate results into CSV inventory, per-package SBOM, and CycloneDX JSON outputs.

How to scan ECR images with syft?▼

Authenticate with aws ecr get-login-password piped to docker login for the correct region endpoint. Syft reads ~/.docker/config.json via its oci-registry provider and pulls images directly without a running Docker daemon.

Why does syft fail to authenticate against ECR?▼

A credsStore value of "desktop" in ~/.docker/config.json intercepts credentials and breaks syft's auth. Set credsStore to an empty string with jq so syft reads the auths entries directly.

How long does scanning a large Kubernetes cluster take?▼

Empirical data shows roughly 50-85 seconds per image on average, so a 99-image batch takes 57-92 minutes. Run batches as background processes with completion notifications instead of active polling to avoid exhausting iteration limits.

What causes MANIFEST_UNKNOWN errors when scanning images?▼

The image tag no longer exists in the registry, often because beta tags were garbage-collected from ECR or ghcr.io images lack a :latest tag. Mark these as stale or unscannable and report them rather than retrying.

Related Skills

Explore More Software Engineering Skills→
datasurfacedatasurface

Setup Kubernetes Registry Secret

Configure a Kubernetes docker-registry secret for GitLab image pulls.

Official
Advanced
ancolemanancoleman
503

managing-vulnerabilities

Automate multi-layer security scanning and SBOM generation in CI/CD pipelines.

Community
Advanced
InnerScopeHearingInnerScopeHearing

embedding-drift-monitor

Compare Azure AI Search probe results against a baseline to detect embedding drift.

Official
Advanced
xalgordxalgord
954

securing-container-registry-images

Secures container registry images with vulnerability scanning, signing, and CI/CD enforcement gates.

Community
Intermediate