How to view node-collector data?

[jonny-wg2]

As part of security incident operations, I was under the impression that node-collector might have useful information such as running processes on each node.

1. How can I view the data that is created by node collector?
2. How often is it run?

[chen-keinan]

@jonny-wg2

• you can see an example of the output on readme on main page
• it is running as part of trivy-operator , event base , on every node deployed

[jonny-wg2]

Hi @chen-keinan , sorry I don't see the output of node-collector on https://github.com/aquasecurity/trivy-operator ?

Event based - would this mean if a new node or process is started then the node-collector would run? I believe from analysis that node-collector will only run once on each node?

[jonny-wg2]

I found this readme https://github.com/aquasecurity/k8s-node-collector

In my case though, I do not see the old node-colelctor pods - they are cleaned up with the trivy-operator. Also in our external logging, I do not see these logs.

[chen-keinan]

@jonny-wg2 sorry for confusion I meant node-collector project readme.
yes once for each node created / updated

[jonny-wg2]

What is the purpose of the node-collector in the trivy-operator. The documentation does not make it clear. In turn, I am wondering if I could leverage this for security incident operations/investigation.

[chen-keinan]

the main purpose is to evaluate node configuration hardening to support cis compliance reports , still it can use to evaluate any node setting which has relevance to security

[xRTRx]

kubectl describe clusterinfraassessmentreports node-<node-name>

[jonny-wg2]

Thanks for the answers. In short, the node-collector is used for compliance reasons and cannot be used for investigative solutions such as "show all running processes on a node".