Containers / Kubernetes

Per-type reference · From docs/INVENTORY_CATALOG.md on GitHub

CONTAINER_REGISTRY

ECR repository, ACR, Artifact Registry.

Catalog entries that classify native resources as this type:

• AWS ARN: ecr-public:repository, ecr:repository
• Azure ARM: microsoft.containerregistry/registries

• GCP Cloud Asset Inventory: artifactregistry.googleapis.com/Repository

• Providers: AWS, AZURE, GCP

• Can be internet-exposed: yes (is_internet_exposed observed true)
• Metadata keys: admin_user_enabled (null), collected_via (str), create_time (null), created_at (str), description (null), encryption_type (str), folders (list), format (str), gcp_asset_type (str), image_count_sampled (int), image_findings (object), image_tag_mutability (str), immutable_tags (bool), kind (null), kms_key_id (null), latest_images (list), location (str), login_server (str), network_tags (list), organization (str), parent_asset_type (null), parent_full_resource_name (str), policy_allows_public (bool), project (str), project_id (str), project_number (str), properties (object), public (bool), public_network_access (str), registry (str), registry_id (str), registry_scan_type (str), replication_destinations (list), repository_uri (str), resource_group (str), resource_type (str), scan_on_push (bool), service (str), sku (null), state (null)
• Carries aliases: yes
• Declared relations: CONTAINS ←
• Edges in:
  CONTAINS ← CLOUD_ACCOUNT, RESOURCE_GROUP
GRANTS_ACCESS / POLICY_ALLOWS_ACTION ← SERVICE_PRINCIPAL
USES_IMAGE ← TASK_DEFINITION
USES_IMAGE / RUNS_ON ← AKS_CLUSTER, APP_SERVICE, BUILD_PROJECT, CONTAINER_SERVICE, JOB_DEFINITION, K8S_WORKLOAD, ML_MODEL, TASK_DEFINITION

CONTAINER_SERVICE

ECS service, Azure Container App.

Catalog entries that classify native resources as this type:

• AWS ARN: ecs:service
• Azure ARM: microsoft.app/containerapps, microsoft.containerinstance/containergroups

• GCP Cloud Asset Inventory: run.googleapis.com/Service

• Providers: AWS, GCP

• Metadata keys: assign_public_ip (bool), cluster_arn (str), create_time (null), description (null), desired_count (int), folders (list), gcp_asset_type (str), images (list), ingress (str), launch_type (str), location (str), network_tags (list), organization (str), parent_asset_type (null), parent_full_resource_name (str), platform (str), project (str), project_id (str), project_number (str), running_count (int), scheduling_strategy (str), security_groups (list), state (null), status (str), subnets (list), task_definition (str), url (str)
• Carries aliases: yes
• Declared relations: ASSUMES_ROLE / RUNS_ON, CONTAINS / CLUSTER_CONTAINS_SERVICE ←, CONTAINS / SUBNET_CONTAINS_INSTANCE ←, REFERENCES / DEPENDS_ON, REFERENCES / DNS_RESOLVED, REFERENCES / READS_FROM, ROUTE / TRANSIT_ROUTED, USES_IMAGE / RUNS_ON
• Edges out:
  ASSUMES_ROLE / RUNS_ON → SERVICE_PRINCIPAL
ATTACHED_TO / PROTECTED_BY_SG → SECURITY_GROUP
REFERENCES / DEPENDS_ON → CLOUD_SQL, TASK_DEFINITION
REFERENCES / DNS_RESOLVED → DNS_RECORD
REFERENCES / READS_FROM → SECRET
ROUTE / TRANSIT_ROUTED → VPC_LINK
USES_IMAGE / RUNS_ON → CONTAINER_REGISTRY
• Edges in:
  CONTAINS ← CLOUD_ACCOUNT
CONTAINS / CLUSTER_CONTAINS_SERVICE ← ECS_CLUSTER
CONTAINS / SUBNET_CONTAINS_INSTANCE ← SUBNET
GRANTS_ACCESS / POLICY_ALLOWS_ACTION ← IDENTITY_PROVIDER
INVOKES / INVOKES ← MESSAGE_QUEUE
LOAD_BALANCER_TARGET / SERVES_TRAFFIC_TO ← TARGET_GROUP
MANAGES ← DEPLOYMENT_GROUP

TASK_DEFINITION

ECS task definition.

Catalog entries that classify native resources as this type:

• AWS ARN: ecs:task-definition

• Providers: AWS

• Metadata keys: compatibilities (list), containers (list), cpu (null), execution_role_arn (null | str), family (str), images (list), memory (null), network_mode (str), revision (int), status (str), task_role_arn (str)
• Declared relations: ASSUMES_ROLE / DEPENDS_ON, ASSUMES_ROLE / RUNS_ON, LOGS_TO / LOGS_TO, USES_IMAGE, USES_IMAGE / RUNS_ON
• Edges out:
  ASSUMES_ROLE / RUNS_ON → IAM_ROLE
USES_IMAGE → CONTAINER_REGISTRY
USES_IMAGE / RUNS_ON → CONTAINER_REGISTRY
• Edges in:
  REFERENCES / DEPENDS_ON ← CONTAINER_SERVICE

NODE_GROUP

EKS nodegroup, AKS agent pool, GKE node pool.

Catalog entries that classify native resources as this type:

• AWS ARN: eks:nodegroup
• Azure ARM: microsoft.containerservice/managedclusters/agentpools

• GCP Cloud Asset Inventory: container.googleapis.com/NodePool

• Providers: AWS, AZURE, GCP

• Metadata keys: ami_type (str), auto_scaling_groups (list), autoscaling (bool), capacity_type (str), cluster_arn (str), cluster_id (str), collected_via (str), count (int), create_time (null), description (null), folders (list), gcp_asset_type (str), instance_types (list), kind (null), location (str), mode (str), network_tags (list), node_role (str), organization (str), os_type (null), parent_asset_type (null), parent_full_resource_name (str), parent_resource (str), pod_subnet_id (null), project (str), project_id (str), project_number (str), properties (object), public_node_ips (null), release_version (str), resource_group (str), resource_type (str), scaling (object), sku (null), state (null), status (str), vm_size (str), vnet_subnet_id (str)
• Carries aliases: yes
• Declared relations: ASSUMES_ROLE / RUNS_ON, ATTACHED_TO / PROTECTED_BY_SG, CONTAINS / CLUSTER_CONTAINS_SERVICE ←, CONTAINS / SUBNET_CONTAINS_INSTANCE ←, MANAGES / SCALES_WITH
• Edges out:
  ASSUMES_ROLE / RUNS_ON → IAM_ROLE, SERVICE_PRINCIPAL
MANAGES / SCALES_WITH → AUTOSCALING_GROUP
• Edges in:
  CONTAINS ← CLOUD_ACCOUNT
CONTAINS / CLUSTER_CONTAINS_SERVICE ← AKS_CLUSTER, EKS_CLUSTER, GKE_CLUSTER
CONTAINS / SUBNET_CONTAINS_INSTANCE ← SUBNET

FARGATE_PROFILE

Catalog entries that classify native resources as this type:

• AWS ARN: eks:fargateprofile

• Providers: AWS

• Metadata keys: cluster_arn (str), selectors (list), status (str)
• Declared relations: ASSUMES_ROLE / RUNS_ON, CONTAINS / CLUSTER_CONTAINS_SERVICE ←, CONTAINS / SUBNET_CONTAINS_INSTANCE ←
• Edges out:
  ASSUMES_ROLE / RUNS_ON → IAM_ROLE
• Edges in:
  CONTAINS / CLUSTER_CONTAINS_SERVICE ← EKS_CLUSTER
CONTAINS / SUBNET_CONTAINS_INSTANCE ← SUBNET

CLUSTER_ADDON

Catalog entries that classify native resources as this type:

• AWS ARN: eks:addon

Not exercised by the fixtures. Produced by collectors or catalogs for resources the test estates do not contain; carries the common keys above plus collector-specific fields.

K8S_NAMESPACE

Catalog entries that classify native resources as this type:

• GCP Cloud Asset Inventory: k8s.io/Namespace

• Providers: AWS

• Metadata keys: cluster_arn (str), kind (str), namespace (str), phase (str)
• Declared relations: CONTAINS / CLUSTER_CONTAINS_SERVICE ←
• Edges out:
  CONTAINS / CLUSTER_CONTAINS_SERVICE → K8S_INGRESS, K8S_SERVICE, K8S_SERVICE_ACCOUNT, K8S_WORKLOAD
• Edges in:
  CONTAINS / CLUSTER_CONTAINS_SERVICE ← EKS_CLUSTER

K8S_WORKLOAD

Deployment, StatefulSet, DaemonSet, CronJob.

Catalog entries that classify native resources as this type:

• GCP Cloud Asset Inventory: apps.k8s.io/DaemonSet, apps.k8s.io/Deployment, apps.k8s.io/StatefulSet, batch.k8s.io/CronJob, batch.k8s.io/Job, k8s.io/Pod

• Providers: AWS

• Metadata keys: cluster_arn (str), host_network (bool), images (list), kind (str), namespace (str), node_selector (object), privileged_containers (list), ready_replicas (null), replicas (int), schedule (null), service_account (str)
• Declared relations: CONTAINS / CLUSTER_CONTAINS_SERVICE ←, REFERENCES / RUNS_ON, USES_IMAGE / RUNS_ON
• Edges out:
  REFERENCES / RUNS_ON → K8S_SERVICE_ACCOUNT
USES_IMAGE / RUNS_ON → CONTAINER_REGISTRY
• Edges in:
  CONTAINS / CLUSTER_CONTAINS_SERVICE ← K8S_NAMESPACE
LOAD_BALANCER_TARGET / SERVES_TRAFFIC_TO ← K8S_SERVICE

K8S_SERVICE

Catalog entries that classify native resources as this type:

• GCP Cloud Asset Inventory: k8s.io/Service

• Providers: AWS

• Can be internet-exposed: yes (is_internet_exposed observed true)
• Metadata keys: cluster_arn (str), internal (bool), kind (str), load_balancer_hostnames (list), namespace (str), ports (list), service_type (str)
• Declared relations: CONTAINS / CLUSTER_CONTAINS_SERVICE ←, LOAD_BALANCER_TARGET / SERVES_TRAFFIC_TO, ROUTE / LOAD_BALANCED_BY ←
• Edges out:
  LOAD_BALANCER_TARGET / SERVES_TRAFFIC_TO → K8S_WORKLOAD
• Edges in:
  CONTAINS / CLUSTER_CONTAINS_SERVICE ← K8S_NAMESPACE
ROUTE / LOAD_BALANCED_BY ← LOAD_BALANCER
ROUTE / SERVES_TRAFFIC_TO ← K8S_INGRESS

K8S_INGRESS

Catalog entries that classify native resources as this type:

• GCP Cloud Asset Inventory: extensions.k8s.io/Ingress, networking.k8s.io/Ingress

• Providers: AWS

• Metadata keys: backends (list), cluster_arn (str), hosts (list), ingress_class (null), kind (str), load_balancer_hostnames (list), namespace (str), tls (bool)
• Declared relations: CONTAINS / CLUSTER_CONTAINS_SERVICE ←, ROUTE / SERVES_TRAFFIC_TO
• Edges out:
  ROUTE / SERVES_TRAFFIC_TO → K8S_SERVICE
• Edges in:
  CONTAINS / CLUSTER_CONTAINS_SERVICE ← K8S_NAMESPACE

K8S_SERVICE_ACCOUNT

Catalog entries that classify native resources as this type:

• GCP Cloud Asset Inventory: k8s.io/ServiceAccount

• Providers: AWS, GCP

• Also discovered via: iam_policy
• Metadata keys: cluster_arn (str), discovered_via (str), irsa_role_arn (str), kind (str), member (str), namespace (str), placeholder (bool), principal_type (str), workload_pool_project (str)
• Carries aliases: yes
• Declared relations: ASSUMES_ROLE / RUNS_ON, CONTAINS / CLUSTER_CONTAINS_SERVICE ←
• Edges out:
  ASSUMES_ROLE / ROLE_ASSUMES_ROLE → SERVICE_PRINCIPAL
ASSUMES_ROLE / RUNS_ON → IAM_ROLE
• Edges in:
  CONTAINS / CLUSTER_CONTAINS_SERVICE ← K8S_NAMESPACE
REFERENCES / RUNS_ON ← K8S_WORKLOAD