stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 2 Releases Wiki Activity

save checkpoint

Browse Source
This commit is contained in:
master
2026-02-14 09:11:48 +02:00
parent 9ca2de05df
commit e9aeadc040
1512 changed files with 30863 additions and 4728 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
docs/features/checked/scanner/mesh-entrypoint-graph.md Normal file
View File

@@ -0,0 +1,38 @@
# Mesh Entrypoint Graph (Multi-Container Reachability)
## Module
Scanner
## Status
VERIFIED
## Description
Cross-container entrypoint reachability analysis that parses Kubernetes and Docker Compose manifests to build a mesh graph of service-to-service connections, enabling vulnerability impact analysis across multi-container deployments.
## Implementation Details
- **Mesh Entrypoint Analysis**:
- `src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace/Mesh/MeshEntrypointAnalyzer.cs` - `MeshEntrypointAnalyzer` performs cross-container entrypoint reachability analysis
- `src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace/Mesh/MeshEntrypointGraph.cs` - `MeshEntrypointGraph` represents the service-to-service connection graph across containers
- **Manifest Parsers**:
- `src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace/Mesh/IManifestParser.cs` - `IManifestParser` interface for container orchestration manifest parsing
- `src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace/Mesh/KubernetesManifestParser.cs` - `KubernetesManifestParser` parses Kubernetes Deployment, Service, and Ingress manifests to extract service topology
- `src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace/Mesh/DockerComposeParser.cs` - `DockerComposeParser` parses Docker Compose files to extract service connections, port mappings, and network topology
## E2E Test Plan
- [ ] Provide a Kubernetes deployment with multiple services and verify the mesh graph correctly maps service-to-service connections
- [ ] Provide a Docker Compose file with linked services and verify cross-container connections are identified
- [ ] Verify a vulnerability in an internet-facing service is classified with higher exposure than one in an internal-only service
- [ ] Verify the mesh graph identifies transitive reachability (service A -> service B -> vulnerable service C)
- [ ] Verify port mappings and network policies are factored into the mesh connectivity analysis
- [ ] Verify the mesh graph handles service discovery (DNS-based and environment variable-based) for connection resolution
---
## Verification
| Check | Result |
|-------|--------|
| Tier 0 - Source files exist | PASS |
| Tier 1 - Build + code review | PASS |
| Tier 2 - Integration tests | PASS |
| Verified | 2026-02-13T18:10:00Z |