vuls-exporter

Sidecar service that reads Vuls scan results and pushes them to the Obmondo API. Runs alongside the Vuls server in Kubernetes.

Architecture

Linux hosts                          Kubernetes cluster
┌─────────────────────┐              ┌──────────────────────────────────┐
│ security-exporter   │──packages──▶ │ vuls-server     │ vuls-exporter │
│ (collects packages, │              │ (scans for CVEs)│ (pushes results│
│  exposes metrics)   │◀──results──  │                 │  to Obmondo API│
└─────────────────────┘              └──────────────────────────────────┘

• security-exporter runs on Linux hosts, collects installed packages, and sends them to the Vuls server
• vuls-exporter (this repo) runs as a sidecar in k8s, reads scan results from the Vuls server, and pushes them to the Obmondo API with mTLS client certificate authentication

How it works

The exporter watches the shared results directory (results_dir) using Linux inotify (IN_CLOSE_WRITE). When vuls-server finishes writing a JSON result file and closes the file descriptor, the exporter detects it immediately and pushes it to the Obmondo API. A periodic ticker (interval) also runs as a fallback to push any files that may have been missed.

Configuration

results_dir: "/vuls/results"
interval: 12h
cleanup:
  enabled: true      # prune old result directories (Vuls never removes them)
  max_age_days: 7    # remove result dirs older than this
  interval: 6h       # how often to prune (defaults to 6h when omitted)
obmondo:
  url: "https://api.obmondo.com"
  cert_file: "/etc/ssl/client.pem"
  key_file: "/etc/ssl/client-key.pem"
  ca_file: "/etc/ssl/ca.pem"

When cleanup.enabled is set, the exporter prunes result directories older than max_age_days on startup and then every interval, so the shared results volume does not grow unbounded between restarts. This requires the results directory to be mounted read-write.

Build

make build

Test

make test
make lint

Release

Releases are cut with cocogitto on an up-to-date main:

cog bump --auto

It tags the merged commit, with no bump commit since changes land through gitea PRs, and pushes main and the tag to origin (gitea) and github, which is not a mirror. The tag on GitHub runs GoReleaser and builds the ghcr.io/obmondo/vuls-exporter image.