39 lines
2.2 KiB
Markdown
39 lines
2.2 KiB
Markdown
# Mesh Entrypoint Graph (Multi-Container Reachability)
|
|
|
|
## Module
|
|
Scanner
|
|
|
|
## Status
|
|
VERIFIED
|
|
|
|
## Description
|
|
Cross-container entrypoint reachability analysis that parses Kubernetes and Docker Compose manifests to build a mesh graph of service-to-service connections, enabling vulnerability impact analysis across multi-container deployments.
|
|
|
|
## Implementation Details
|
|
- **Mesh Entrypoint Analysis**:
|
|
- `src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace/Mesh/MeshEntrypointAnalyzer.cs` - `MeshEntrypointAnalyzer` performs cross-container entrypoint reachability analysis
|
|
- `src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace/Mesh/MeshEntrypointGraph.cs` - `MeshEntrypointGraph` represents the service-to-service connection graph across containers
|
|
- **Manifest Parsers**:
|
|
- `src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace/Mesh/IManifestParser.cs` - `IManifestParser` interface for container orchestration manifest parsing
|
|
- `src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace/Mesh/KubernetesManifestParser.cs` - `KubernetesManifestParser` parses Kubernetes Deployment, Service, and Ingress manifests to extract service topology
|
|
- `src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace/Mesh/DockerComposeParser.cs` - `DockerComposeParser` parses Docker Compose files to extract service connections, port mappings, and network topology
|
|
|
|
## E2E Test Plan
|
|
- [ ] Provide a Kubernetes deployment with multiple services and verify the mesh graph correctly maps service-to-service connections
|
|
- [ ] Provide a Docker Compose file with linked services and verify cross-container connections are identified
|
|
- [ ] Verify a vulnerability in an internet-facing service is classified with higher exposure than one in an internal-only service
|
|
- [ ] Verify the mesh graph identifies transitive reachability (service A -> service B -> vulnerable service C)
|
|
- [ ] Verify port mappings and network policies are factored into the mesh connectivity analysis
|
|
- [ ] Verify the mesh graph handles service discovery (DNS-based and environment variable-based) for connection resolution
|
|
|
|
---
|
|
|
|
## Verification
|
|
|
|
| Check | Result |
|
|
|-------|--------|
|
|
| Tier 0 - Source files exist | PASS |
|
|
| Tier 1 - Build + code review | PASS |
|
|
| Tier 2 - Integration tests | PASS |
|
|
| Verified | 2026-02-13T18:10:00Z |
|