Issues

• CLI-initiated image scanning: scan an image with the kguardian plugin, report it in the UI

  kguardian-dev/kguardian#1896 · Filter by author maheshrayas opened on Sep 30, 2026

• Detect known vulnerabilities on nodes (host OS packages)

  enhancement
  kguardian-dev/kguardian#1891 · Filter by author maheshrayas opened on Sep 30, 2026
  1

• Security Feature: Runtime SBOM scanning, Vulnerability management and Image attestation validation

  kguardian-dev/kguardian#1533 · Filter by author maheshrayas opened on Sep 10, 2026

• Finops feature: recommend the CPU and RAM usage based on the historical data(1 week)

  Feature

  kguardian-dev/kguardian#1532 · Filter by author maheshrayas opened on Sep 10, 2026

• controller: a flow is marked sent before the post, so queue overflow during a broker outage loses it permanently

  kguardian-dev/kguardian#1523 · Filter by author xunholy opened on Sep 9, 2026

• controller: TRAFFIC_CACHE dedup is check-then-act across an await, so concurrent duplicates both pass

  kguardian-dev/kguardian#1504 · Filter by author xunholy opened on Sep 8, 2026

• controller: the 60s pod resync re-queues a registration for every on-node pod, so the inode channel carries ~180 redundant sends a minute

  kguardian-dev/kguardian#1501 · Filter by author xunholy opened on Sep 7, 2026

• broker auth is a single shared token, so enabling it still lets any token holder forge the traffic rows that steer generated policy

  kguardian-dev/kguardian#1500 · Filter by author xunholy opened on Sep 7, 2026

• evaluator: status aggregator retains a tuple per denied flow forever, so memory and flush lock-hold grow with denial volume

  kguardian-dev/kguardian#1498 · Filter by author xunholy opened on Sep 7, 2026

• policy builder emits a rule-less NetworkPolicy for a zero-traffic pod, which reads as inert but isolates the workload for ingress

  kguardian-dev/kguardian#1496 · Filter by author xunholy opened on Sep 7, 2026

• generated policy selector falls back to per-revision pod labels when the owner chain is unrecognised, so it stops matching after a rollout or CronJob tick

  kguardian-dev/kguardian#1494 · Filter by author xunholy opened on Sep 7, 2026

• TRAFFIC_CACHE hit rate is unmeasured: a per-node 10,000-entry global budget shared across ~234 pods, with no eviction visibility

  kguardian-dev/kguardian#1487 · Filter by author xunholy opened on Sep 7, 2026

• advisor: a pod with ~18k+ traffic rows gets no policy at all, because the 10 MB response cap truncates then fails to parse

  kguardian-dev/kguardian#1486 · Filter by author xunholy opened on Sep 7, 2026

• retention silently does not cover pod_traffic or pod_syscalls, so configuring a retention period does not bound the observation data

  kguardian-dev/kguardian#1484 · Filter by author xunholy opened on Sep 7, 2026

• Broker API is unauthenticated by default while serving full cluster telemetry

  kguardian-dev/kguardian#1342 · Filter by author xunholy opened on Aug 30, 2026

• Renovate Dashboard 🤖

  kguardian-dev/kguardian#53 · Filter by author kguardian-bot opened on May 15, 2024