Kubernetes Schema
graph LR
KubernetesCluster -- RESOURCE --> KubernetesClusterRole
KubernetesCluster -- RESOURCE --> KubernetesClusterRoleBinding
KubernetesCluster -- RESOURCE --> KubernetesContainer
KubernetesCluster -- RESOURCE --> KubernetesCronJob
KubernetesCluster -- RESOURCE --> KubernetesDaemonSet
KubernetesCluster -- RESOURCE --> KubernetesDeployment
KubernetesCluster -- RESOURCE --> KubernetesGateway
KubernetesCluster -- RESOURCE --> KubernetesGroup
KubernetesCluster -- RESOURCE --> KubernetesHTTPRoute
KubernetesCluster -- RESOURCE --> KubernetesIngress
KubernetesCluster -- RESOURCE --> KubernetesJob
KubernetesCluster -- RESOURCE --> KubernetesNamespace
KubernetesCluster -- RESOURCE --> KubernetesNetworkPolicy
KubernetesCluster -- RESOURCE --> KubernetesNode
KubernetesCluster -- RESOURCE --> KubernetesOIDCProvider
KubernetesCluster -- RESOURCE --> KubernetesPod
KubernetesCluster -- RESOURCE --> KubernetesReplicaSet
KubernetesCluster -- RESOURCE --> KubernetesRole
KubernetesCluster -- RESOURCE --> KubernetesRoleBinding
KubernetesCluster -- RESOURCE --> KubernetesSecret
KubernetesCluster -- RESOURCE --> KubernetesService
KubernetesCluster -- RESOURCE --> KubernetesServiceAccount
KubernetesCluster -- RESOURCE --> KubernetesStatefulSet
KubernetesCluster -- RESOURCE --> KubernetesUser
KubernetesCluster -- TRUSTS --> KubernetesOIDCProvider
KubernetesClusterRoleBinding -- ROLE_REF --> KubernetesClusterRole
KubernetesClusterRoleBinding -- SUBJECT --> KubernetesGroup
KubernetesClusterRoleBinding -- SUBJECT --> KubernetesServiceAccount
KubernetesClusterRoleBinding -- SUBJECT --> KubernetesUser
KubernetesContainer -- WORKLOAD_PARENT --> KubernetesPod
KubernetesCronJob -- WORKLOAD_PARENT --> KubernetesNamespace
KubernetesDaemonSet -- WORKLOAD_PARENT --> KubernetesNamespace
KubernetesDeployment -- WORKLOAD_PARENT --> KubernetesNamespace
KubernetesGateway -- ROUTES --> KubernetesHTTPRoute
KubernetesHTTPRoute -- TARGETS --> KubernetesService
KubernetesIngress -- TARGETS --> KubernetesService
KubernetesJob -- WORKLOAD_PARENT --> KubernetesCronJob
KubernetesJob -- WORKLOAD_PARENT --> KubernetesNamespace
KubernetesNamespace -- CONTAINS --> KubernetesContainer
KubernetesNamespace -- CONTAINS --> KubernetesGateway
KubernetesNamespace -- CONTAINS --> KubernetesHTTPRoute
KubernetesNamespace -- CONTAINS --> KubernetesIngress
KubernetesNamespace -- CONTAINS --> KubernetesNetworkPolicy
KubernetesNamespace -- CONTAINS --> KubernetesPod
KubernetesNamespace -- CONTAINS --> KubernetesRole
KubernetesNamespace -- CONTAINS --> KubernetesRoleBinding
KubernetesNamespace -- CONTAINS --> KubernetesSecret
KubernetesNamespace -- CONTAINS --> KubernetesService
KubernetesNamespace -- CONTAINS --> KubernetesServiceAccount
KubernetesNamespace -- WORKLOAD_PARENT --> KubernetesCluster
KubernetesNetworkPolicy -- APPLIES_TO --> KubernetesPod
KubernetesPod -- CONTAINS --> KubernetesContainer
KubernetesPod -- OWNED_BY --> KubernetesReplicaSet
KubernetesPod -- RUNS_AS --> KubernetesServiceAccount
KubernetesPod -- RUNS_ON --> KubernetesNode
KubernetesPod -- USES_SECRET --> KubernetesSecret
KubernetesPod -- USES_SECRET_ENV --> KubernetesSecret
KubernetesPod -- USES_SECRET_VOLUME --> KubernetesSecret
KubernetesPod -- USES_SERVICE_ACCOUNT --> KubernetesServiceAccount
KubernetesPod -- WORKLOAD_PARENT --> KubernetesDaemonSet
KubernetesPod -- WORKLOAD_PARENT --> KubernetesDeployment
KubernetesPod -- WORKLOAD_PARENT --> KubernetesJob
KubernetesPod -- WORKLOAD_PARENT --> KubernetesNamespace
KubernetesPod -- WORKLOAD_PARENT --> KubernetesStatefulSet
KubernetesReplicaSet -- OWNED_BY --> KubernetesDeployment
KubernetesRoleBinding -- ROLE_REF --> KubernetesRole
KubernetesRoleBinding -- SUBJECT --> KubernetesGroup
KubernetesRoleBinding -- SUBJECT --> KubernetesServiceAccount
KubernetesRoleBinding -- SUBJECT --> KubernetesUser
KubernetesService -- TARGETS --> KubernetesPod
KubernetesStatefulSet -- WORKLOAD_PARENT --> KubernetesNamespaceKubernetesCluster
A Kubernetes cluster discovered from a kubeconfig context.
Ontology Mapping: This node uses the ontology label
ComputeCluster.
Properties
Ontology-generated fields are shown in italics.
| Field | Index | Description |
|---|---|---|
| id | Yes | Identifier for the cluster i.e. UID of kube-system namespace. |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| api_server_url | Kubernetes API server URL from kubeconfig. | |
| compiler | Compiler used to build Kubernetes (e.g. gc). | |
| creation_timestamp | Timestamp of when the cluster was created i.e. creation of kube-system namespace. |
|
| external_id | Yes | Identifier for the cluster fetched from the kubeconfig context. For EKS clusters this should be the arn. |
| go_version | Version of Go used to compile Kubernetes (e.g. go1.20.5). | |
| kubeconfig_ca_file_path | CA file path from kubeconfig when certificate-authority is configured. |
|
| kubeconfig_has_certificate_authority_data | True when kubeconfig has inline certificate-authority-data for this cluster. |
|
| kubeconfig_has_certificate_authority_file | True when kubeconfig has a certificate-authority file path for this cluster. |
|
| kubeconfig_has_client_certificate | True when kubeconfig user has a client cert (client-certificate or client-certificate-data). |
|
| kubeconfig_has_client_key | True when kubeconfig user has a client key (client-key or client-key-data). |
|
| kubeconfig_insecure_skip_tls_verify | Whether kubeconfig is configured to skip API server TLS verification. | |
| kubeconfig_tls_configuration_status | Derived kubeconfig TLS posture (valid_config, insecure_skip_tls, missing_ca_material, unknown). |
|
| name | Yes | Name assigned to the cluster which is derived from kubeconfig context. |
| platform | Operating system and architecture the cluster is running on (e.g. linux/amd64). | |
| version | Git version of the Kubernetes cluster (e.g. v1.27.3). | |
| version_major | Major version number of the Kubernetes cluster (e.g. 1). | |
| version_minor | Minor version number of the Kubernetes cluster (e.g. 27). | |
| _ont_name | Yes | Normalized field sourced from name. |
| _ont_source | Module that populated this node's ontology fields. | |
| _ont_version | Yes | Normalized field sourced from version. |
Relationships
(:AWSEKSCluster)-[:MAPS_TO]->(:KubernetesCluster): Links an EKS cluster to the Kubernetes cluster it hosts.(:KubernetesCluster)-[:RESOURCE]->(:KubernetesClusterRole): Links a cluster to one of its cluster roles.(:KubernetesCluster)-[:RESOURCE]->(:KubernetesClusterRoleBinding): Links a cluster to one of its cluster role bindings.(:KubernetesCluster)-[:RESOURCE]->(:KubernetesContainer): Links a cluster to one of its containers.(:KubernetesCluster)-[:RESOURCE]->(:KubernetesCronJob): Links a cluster to one of its cron jobs.(:KubernetesCluster)-[:RESOURCE]->(:KubernetesDaemonSet): Links a cluster to one of its daemon sets.(:KubernetesCluster)-[:RESOURCE]->(:KubernetesDeployment): Links a cluster to one of its deployments.(:KubernetesCluster)-[:RESOURCE]->(:KubernetesGateway): Links a cluster to one of its gateways.(:KubernetesCluster)-[:RESOURCE]->(:KubernetesGroup): Links a cluster to one of its groups.(:KubernetesCluster)-[:RESOURCE]->(:KubernetesHTTPRoute): Links a cluster to one of its HTTP routes.(:KubernetesCluster)-[:RESOURCE]->(:KubernetesIngress): Links a cluster to one of its ingresses.(:KubernetesCluster)-[:RESOURCE]->(:KubernetesJob): Links a cluster to one of its jobs.(:KubernetesCluster)-[:RESOURCE]->(:KubernetesNamespace): Links a cluster to one of its namespaces.(:KubernetesCluster)-[:RESOURCE]->(:KubernetesNetworkPolicy): Links a cluster to one of its network policies.(:KubernetesCluster)-[:RESOURCE]->(:KubernetesNode): Links a cluster to one of its nodes.(:KubernetesCluster)-[:RESOURCE]->(:KubernetesOIDCProvider): Links a cluster to one of its OIDC providers.(:KubernetesCluster)-[:RESOURCE]->(:KubernetesPod): Links a cluster to a pod running in it.(:KubernetesCluster)-[:RESOURCE]->(:KubernetesReplicaSet): Links a cluster to one of its replica sets.(:KubernetesCluster)-[:RESOURCE]->(:KubernetesRole): Links a cluster to one of its roles.(:KubernetesCluster)-[:RESOURCE]->(:KubernetesRoleBinding): Links a cluster to one of its role bindings.(:KubernetesCluster)-[:RESOURCE]->(:KubernetesSecret): Links a cluster to one of its secrets.(:KubernetesCluster)-[:RESOURCE]->(:KubernetesService): Links a cluster to one of its services.(:KubernetesCluster)-[:RESOURCE]->(:KubernetesServiceAccount): Links a cluster to one of its service accounts.(:KubernetesCluster)-[:RESOURCE]->(:KubernetesStatefulSet): Links a cluster to one of its stateful sets.(:KubernetesCluster)-[:RESOURCE]->(:KubernetesUser): Links a cluster to one of its users.(:KubernetesCluster)-[:TRUSTS]->(:KubernetesOIDCProvider): Links a cluster to an OIDC provider it accepts tokens from.(:KubernetesNamespace)-[:WORKLOAD_PARENT]->(:KubernetesCluster): Links a namespace to the cluster it belongs to.
KubernetesClusterRole
A cluster-scoped Kubernetes RBAC role.
Ontology Mapping: This node uses the ontology label
PermissionRole.
Properties
Ontology-generated fields are shown in italics.
| Field | Index | Description |
|---|---|---|
| id | Yes | Identifier for the ClusterRole derived from cluster_name and name (e.g. my-cluster/cluster-admin). |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| api_groups | List of API groups that this ClusterRole grants access to (e.g. ["core", "apps"]). |
|
| creation_timestamp | Timestamp of the creation time of the Kubernetes ClusterRole. | |
| name | Name of the Kubernetes ClusterRole. | |
| resource_version | The resource version of the ClusterRole for optimistic concurrency control. | |
| resources | List of resources that this ClusterRole grants access to (e.g. ["pods", "services"]). |
|
| uid | UID of the Kubernetes ClusterRole. | |
| verbs | List of verbs/actions that this ClusterRole allows (e.g. ["get", "list", "create"]). |
|
| _ont_name | Yes | Normalized field sourced from name. |
| _ont_scope | Yes | Property generated by the ontology mapping. |
| _ont_source | Module that populated this node's ontology fields. |
Relationships
(:KubernetesCluster)-[:RESOURCE]->(:KubernetesClusterRole): Links a cluster to one of its cluster roles.(:KubernetesClusterRoleBinding)-[:ROLE_REF]->(:KubernetesClusterRole): Links a cluster role binding to the cluster role it grants.
KubernetesClusterRoleBinding
A cluster-scoped binding between RBAC subjects and a cluster role.
Properties
| Field | Index | Description |
|---|---|---|
| id | Yes | Identifier for the ClusterRoleBinding derived from cluster_name and name (e.g. my-cluster/cluster-admin-binding). |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| creation_timestamp | Timestamp of the creation time of the Kubernetes ClusterRoleBinding. | |
| group_ids | Identifiers of bound group subjects. | |
| name | Name of the Kubernetes ClusterRoleBinding. | |
| resource_version | The resource version of the ClusterRoleBinding for optimistic concurrency control. | |
| role_id | Identifier for the target ClusterRole (used for relationship matching). | |
| role_kind | Kind of the role reference (typically ClusterRole). |
|
| role_name | Yes | Name of the ClusterRole that this ClusterRoleBinding references. |
| service_account_ids | Identifiers of bound service account subjects. | |
| uid | UID of the Kubernetes ClusterRoleBinding. | |
| user_ids | Identifiers of bound user subjects. |
Relationships
(:KubernetesCluster)-[:RESOURCE]->(:KubernetesClusterRoleBinding): Links a cluster to one of its cluster role bindings.(:KubernetesClusterRoleBinding)-[:ROLE_REF]->(:KubernetesClusterRole): Links a cluster role binding to the cluster role it grants.(:KubernetesClusterRoleBinding)-[:SUBJECT]->(:KubernetesGroup): Links a cluster role binding to a group it grants its role to.(:KubernetesClusterRoleBinding)-[:SUBJECT]->(:KubernetesServiceAccount): Links a cluster role binding to a service account it grants its role to.(:KubernetesClusterRoleBinding)-[:SUBJECT]->(:KubernetesUser): Links a cluster role binding to a user it grants its role to.
KubernetesContainer
A container declared by a Kubernetes pod.
Ontology Mapping: This node uses the ontology label
Container.
Properties
Ontology-generated fields are shown in italics.
| Field | Index | Description |
|---|---|---|
| id | Yes | Identifier for the container which is derived from the UID of pod and the name of container. |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| added_capabilities | Linux capabilities explicitly added to the container. Derived from container.security_context.capabilities.add. |
|
| allow_privilege_escalation | Whether the container explicitly allows privilege escalation. Derived from container.security_context.allow_privilege_escalation. |
|
| architecture_normalized | Canonical CPU architecture derived from the scheduled node when available (e.g. amd64, arm64). |
|
| cluster_name | Yes | Name of the Kubernetes cluster where this container is deployed. |
| container_port_numbers | Yes | Flat, queryable list of the declared TCP/UDP containerPort numbers. Derived from container.ports[].container_port. An empty list means the container declares no ports; it is not proof that the container listens on nothing, since a process can bind ports it never declared. |
| container_ports | The ports the container declares in its pod spec. Derived from container.ports[], stored as a JSON-encoded list of {container_port, protocol, name}. containerPort is optional in Kubernetes, so this reflects declared ports only, not necessarily every port the process listens on. |
|
| cpu_limit | Maximum amount of CPU the container is allowed to use (e.g. "500m", "2"). | |
| cpu_request | Minimum amount of CPU guaranteed to be available to the container (e.g. "100m", "1"). | |
| dropped_capabilities | Linux capabilities explicitly dropped by the container. Derived from container.security_context.capabilities.drop. |
|
| exposed_internet | Yes | True when the container's pod is targeted by an internet-exposed service. False otherwise. |
| exposed_internet_type | Yes | How it is exposed. Always lb. |
| host_ports | List of host ports exposed by the container. Derived from container.ports[].host_port. |
|
| image | Yes | Docker image used in the container. |
| image_pull_policy | The policy that determines when the kubelet attempts to pull the specified image (Always, Never, IfNotPresent). | |
| memory_limit | Maximum amount of memory the container is allowed to use (e.g. "256Mi", "2Gi"). | |
| memory_request | Minimum amount of memory guaranteed to be available to the container (e.g. "128Mi", "1Gi"). | |
| name | Yes | Name of the container in kubernetes pod. |
| namespace | Yes | The Kubernetes namespace where this container is deployed. |
| region | Cloud region associated with the Kubernetes cluster. | |
| run_as_non_root | Whether the container is configured to run as non-root. Derived from container.security_context.run_as_non_root. |
|
| run_as_user | Explicit UID configured for the container. Derived from container.security_context.run_as_user. |
|
| seccomp_profile_type | Container-level seccomp profile type when set, such as RuntimeDefault. Derived from container.security_context.seccomp_profile.type. |
|
| status_image_id | Runtime-reported image identifier for the container. This may differ from the declared image field because the container runtime can rewrite tags or parent image indexes to digest-qualified references. |
|
| status_image_sha | Yes | The SHA portion of the runtime-reported status_image_id when Cartography can extract it. |
| status_ready | Specifies whether the container has passed its readiness probe. | |
| status_started | Specifies whether the container has passed its startup probe. | |
| status_state | Yes | State of the container (running, terminated, waiting). |
| _ont_image | Yes | Normalized field sourced from image. |
| _ont_image_digest | Yes | Normalized field sourced from status_image_sha. |
| _ont_name | Yes | Normalized field sourced from name. |
| _ont_namespace | Yes | Normalized field sourced from namespace. |
| _ont_region | Yes | Normalized field sourced from region. |
| _ont_source | Module that populated this node's ontology fields. | |
| _ont_state | Yes | Normalized field sourced from status_state. |
Relationships
(:AWSLoadBalancerV2)-[:EXPOSE]->(:KubernetesContainer): generated by analysis jobKubernetes LoadBalancer to container EXPOSE relationships.Properties:
Field Description exposure_type Property generated by analysis job: Kubernetes LoadBalancer to container EXPOSE relationships.
(:KubernetesCluster)-[:RESOURCE]->(:KubernetesContainer): Links a cluster to one of its containers.(:KubernetesContainer)-[:HAS_IMAGE]->(:AWSECRImage): Links a container to the image it runs, hosted in Amazon ECR.(:KubernetesContainer)-[:HAS_IMAGE]->(:GCPArtifactRegistryImage): Links a container to the image it runs, hosted in Artifact Registry.(:KubernetesContainer)-[:HAS_IMAGE]->(:GitHubContainerImage): Links a container to the image it runs, hosted in GitHub Container Registry.(:KubernetesContainer)-[:HAS_IMAGE]->(:GitLabContainerImage): Links a container to the image it runs, hosted in the GitLab registry.(:KubernetesContainer)-[:WORKLOAD_PARENT]->(:KubernetesPod): Links a container to the pod it runs in.(:KubernetesNamespace)-[:CONTAINS]->(:KubernetesContainer): Links a namespace to a container it contains.(:KubernetesPod)-[:CONTAINS]->(:KubernetesContainer): Links a pod to a container it runs.
KubernetesCronJob
A Kubernetes CronJob that creates Jobs on a recurring schedule.
Ontology Mapping: This node uses the ontology label
ComputeService.
Properties
Ontology-generated fields are shown in italics.
| Field | Index | Description |
|---|---|---|
| id | Yes | UID of the Kubernetes CronJob. |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| cluster_name | Yes | Name of the Kubernetes cluster containing the CronJob. |
| creation_timestamp | Timestamp when the Kubernetes CronJob was created. | |
| deletion_timestamp | Timestamp when the Kubernetes CronJob was marked for deletion. | |
| labels | Metadata labels on the CronJob, stored as a JSON-encoded string. | |
| name | Yes | Name of the Kubernetes CronJob. |
| namespace | Yes | Kubernetes namespace containing the CronJob. |
| schedule | Cron schedule used to create Jobs. | |
| suspend | Whether creation of new Jobs is suspended. | |
| _ont_name | Yes | Normalized field sourced from name. |
| _ont_source | Module that populated this node's ontology fields. |
Relationships
(:KubernetesCluster)-[:RESOURCE]->(:KubernetesCronJob): Links a cluster to one of its cron jobs.(:KubernetesCronJob)-[:WORKLOAD_PARENT]->(:KubernetesNamespace): Links a cron job to the namespace that owns it.(:KubernetesJob)-[:WORKLOAD_PARENT]->(:KubernetesCronJob): Links a job to the cron job that created it.
KubernetesDaemonSet
A Kubernetes DaemonSet that runs pods across selected cluster nodes.
Ontology Mapping: This node uses the ontology label
ComputeService.
Properties
Ontology-generated fields are shown in italics.
| Field | Index | Description |
|---|---|---|
| id | Yes | UID of the Kubernetes DaemonSet. |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| cluster_name | Yes | Name of the Kubernetes cluster containing the DaemonSet. |
| creation_timestamp | Timestamp when the Kubernetes DaemonSet was created. | |
| deletion_timestamp | Timestamp when the Kubernetes DaemonSet was marked for deletion. | |
| desired_number_scheduled | Number of nodes that should run a pod from the DaemonSet. | |
| labels | Metadata labels on the DaemonSet, stored as a JSON-encoded string. | |
| name | Yes | Name of the Kubernetes DaemonSet. |
| namespace | Yes | Kubernetes namespace containing the DaemonSet. |
| number_ready | Number of nodes running a ready pod from the DaemonSet. | |
| _ont_name | Yes | Normalized field sourced from name. |
| _ont_source | Module that populated this node's ontology fields. |
Relationships
(:KubernetesCluster)-[:RESOURCE]->(:KubernetesDaemonSet): Links a cluster to one of its daemon sets.(:KubernetesDaemonSet)-[:WORKLOAD_PARENT]->(:KubernetesNamespace): Links a daemon set to the namespace that owns it.(:KubernetesPod)-[:WORKLOAD_PARENT]->(:KubernetesDaemonSet)
KubernetesDeployment
A Kubernetes Deployment that manages a replicated application workload.
Ontology Mapping: This node uses the ontology label
ComputeService.
Properties
Ontology-generated fields are shown in italics.
| Field | Index | Description |
|---|---|---|
| id | Yes | UID of the Kubernetes Deployment. |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| available_replicas | Number of pod replicas that are available. | |
| cluster_name | Yes | Name of the Kubernetes cluster containing the Deployment. |
| creation_timestamp | Timestamp when the Kubernetes Deployment was created. | |
| deletion_timestamp | Timestamp when the Kubernetes Deployment was marked for deletion. | |
| labels | Metadata labels on the Deployment, stored as a JSON-encoded string. | |
| name | Yes | Name of the Kubernetes Deployment. |
| namespace | Yes | Kubernetes namespace containing the Deployment. |
| ready_replicas | Number of pod replicas that are ready. | |
| replicas | Desired number of pod replicas. | |
| _ont_name | Yes | Normalized field sourced from name. |
| _ont_source | Module that populated this node's ontology fields. |
Relationships
(:KubernetesCluster)-[:RESOURCE]->(:KubernetesDeployment): Links a cluster to one of its deployments.(:KubernetesDeployment)-[:WORKLOAD_PARENT]->(:KubernetesNamespace): Links a deployment to the namespace that owns it.(:KubernetesPod)-[:WORKLOAD_PARENT]->(:KubernetesDeployment)(:KubernetesReplicaSet)-[:OWNED_BY]->(:KubernetesDeployment): Links a replica set to the deployment that manages it.
KubernetesGateway
A Gateway API gateway that accepts traffic for attached routes.
Properties
| Field | Index | Description |
|---|---|---|
| id | Yes | UID of the Gateway. |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| cluster_name | Yes | Name of the Kubernetes cluster where this Gateway is deployed. |
| creation_timestamp | Epoch seconds of metadata.creationTimestamp. |
|
| deletion_timestamp | Epoch seconds of metadata.deletionTimestamp. |
|
| gateway_class_name | Name of the GatewayClass referenced by spec.gatewayClassName. |
|
| name | Yes | Name of the Gateway. |
| namespace | Yes | The Kubernetes namespace where this Gateway is deployed. |
| qualified_name | Yes | <namespace>/<name> identifier used to match the Gateway from HTTPRoute.spec.parentRefs. |
Relationships
(:KubernetesCluster)-[:RESOURCE]->(:KubernetesGateway): Links a cluster to one of its gateways.(:KubernetesGateway)-[:ROUTES]->(:KubernetesHTTPRoute): Links a gateway to an HTTP route attached to it.(:KubernetesNamespace)-[:CONTAINS]->(:KubernetesGateway): Links a namespace to a gateway it contains.
KubernetesGroup
A group identity referenced by Kubernetes RBAC.
Ontology Mapping: This node uses the ontology label
UserGroup.
Properties
Ontology-generated fields are shown in italics.
| Field | Index | Description |
|---|---|---|
| id | Yes | Identifier for the group. |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| cluster_name | Name of the cluster this group belongs to. | |
| name | Name of the Kubernetes group. | |
| _ont_name | Yes | Normalized field sourced from name. |
| _ont_source | Module that populated this node's ontology fields. |
Relationships
(:AWSRole)-[:MAPS_TO]->(:KubernetesGroup): Links an AWS IAM role to the Kubernetes group it maps to.(:AWSUser)-[:MAPS_TO]->(:KubernetesGroup): Links an AWS IAM user to the Kubernetes group it maps to.(:KubernetesCluster)-[:RESOURCE]->(:KubernetesGroup): Links a cluster to one of its groups.(:KubernetesClusterRoleBinding)-[:SUBJECT]->(:KubernetesGroup): Links a cluster role binding to a group it grants its role to.(:KubernetesRoleBinding)-[:SUBJECT]->(:KubernetesGroup): Links a role binding to a group it grants its role to.(:OktaGroup)-[:MAPS_TO]->(:KubernetesGroup): Links an Okta group to the Kubernetes group it maps to.
KubernetesHTTPRoute
A Gateway API HTTPRoute that forwards traffic to services.
Properties
| Field | Index | Description |
|---|---|---|
| id | Yes | UID of the HTTPRoute. |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| cluster_name | Yes | Name of the Kubernetes cluster where this HTTPRoute is deployed. |
| creation_timestamp | Epoch seconds of metadata.creationTimestamp. |
|
| deletion_timestamp | Epoch seconds of metadata.deletionTimestamp. |
|
| hostnames | List of hostnames from spec.hostnames. |
|
| name | Yes | Name of the HTTPRoute. |
| namespace | Yes | The Kubernetes namespace where this HTTPRoute is deployed. |
| qualified_name | Yes | <namespace>/<name> identifier used to match this HTTPRoute from Gateway parents. |
Relationships
(:KubernetesCluster)-[:RESOURCE]->(:KubernetesHTTPRoute): Links a cluster to one of its HTTP routes.(:KubernetesGateway)-[:ROUTES]->(:KubernetesHTTPRoute): Links a gateway to an HTTP route attached to it.(:KubernetesHTTPRoute)-[:TARGETS]->(:KubernetesService): Links an HTTP route to a service it forwards traffic to.(:KubernetesNamespace)-[:CONTAINS]->(:KubernetesHTTPRoute): Links a namespace to a HTTP route it contains.
KubernetesIngress
A Kubernetes ingress that routes external traffic to services.
Properties
| Field | Index | Description |
|---|---|---|
| id | Yes | UID of the Kubernetes Ingress. |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| annotations | Annotations on the Ingress resource. Stored as a JSON-encoded string. Contains controller-specific configuration. | |
| cluster_name | Name of the Kubernetes cluster where this Ingress is deployed. | |
| creation_timestamp | Timestamp of the creation time of the Kubernetes Ingress. | |
| default_backend | A default backend capable of servicing requests that don't match any rule. Stored as a JSON-encoded string. | |
| deletion_timestamp | Timestamp of the deletion time of the Kubernetes Ingress. | |
| host_names | Hostnames configured by the ingress rules. | |
| ingress_class_name | The name of the IngressClass cluster resource. Specifies which controller will implement the ingress (e.g. nginx, alb). |
|
| ingress_group_name | Yes | The ingress group name from the alb.ingress.kubernetes.io/group.name annotation (AWS Load Balancer Controller). Allows multiple Ingresses to share a single ALB. |
| load_balancer_dns_names | List of DNS hostnames from the Ingress status. Used to match to cloud load balancers (e.g., AWS ALB). | |
| name | Name of the Kubernetes Ingress. | |
| namespace | Yes | The Kubernetes namespace where this Ingress is deployed. |
| rules | The list of host rules used to configure the Ingress. Stored as a JSON-encoded string containing host/path routing rules. |
Relationships
(:DNSRecord)-[:DNS_POINTS_TO]->(:KubernetesIngress): generated by analysis jobOntology - DNSRecord to KubernetesIngress linking.(:KubernetesCluster)-[:RESOURCE]->(:KubernetesIngress): Links a cluster to one of its ingresses.(:KubernetesIngress)-[:TARGETS]->(:KubernetesService): Links an ingress to a service it routes traffic to.(:KubernetesIngress)-[:USES_LOAD_BALANCER]->(:AWSLoadBalancerV2): Links an ingress to the AWS load balancer that exposes it, matched by the DNS hostname from the ingress status to the load balancer's DNS name; both are lowercased at ingestion.(:KubernetesNamespace)-[:CONTAINS]->(:KubernetesIngress): Links a namespace to an ingress it contains.
KubernetesJob
A Kubernetes Job that runs pods to completion.
Ontology Mapping: This node uses the ontology label
ComputeService.
Properties
Ontology-generated fields are shown in italics.
| Field | Index | Description |
|---|---|---|
| id | Yes | UID of the Kubernetes Job. |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| active | Number of pods currently running for the Job. | |
| cluster_name | Yes | Name of the Kubernetes cluster containing the Job. |
| completions | Desired number of successfully completed pods. | |
| creation_timestamp | Timestamp when the Kubernetes Job was created. | |
| deletion_timestamp | Timestamp when the Kubernetes Job was marked for deletion. | |
| failed | Number of pods that completed unsuccessfully. | |
| labels | Metadata labels on the Job, stored as a JSON-encoded string. | |
| name | Yes | Name of the Kubernetes Job. |
| namespace | Yes | Kubernetes namespace containing the Job. |
| parallelism | Maximum number of pods that may run in parallel. | |
| succeeded | Number of pods that completed successfully. | |
| _ont_name | Yes | Normalized field sourced from name. |
| _ont_source | Module that populated this node's ontology fields. |
Relationships
(:KubernetesCluster)-[:RESOURCE]->(:KubernetesJob): Links a cluster to one of its jobs.(:KubernetesJob)-[:WORKLOAD_PARENT]->(:KubernetesCronJob): Links a job to the cron job that created it.(:KubernetesJob)-[:WORKLOAD_PARENT]->(:KubernetesNamespace): Links a job to the namespace that owns it.(:KubernetesPod)-[:WORKLOAD_PARENT]->(:KubernetesJob)
KubernetesNamespace
A namespace that scopes resources in a Kubernetes cluster.
Ontology Mapping: This node uses the ontology label
ComputeNamespace.
Properties
Ontology-generated fields are shown in italics.
| Field | Index | Description |
|---|---|---|
| id | Yes | UID of the Kubernetes namespace. |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| cluster_name | Yes | The name of the Kubernetes cluster this namespace belongs to. |
| creation_timestamp | Timestamp of the creation time of the Kubernetes namespace. | |
| deletion_timestamp | Timestamp of the deletion time of the Kubernetes namespace. | |
| name | Yes | Name of the Kubernetes namespace. |
| status_phase | The phase of a Kubernetes namespace indicates whether it is active, terminating, or terminated. | |
| _ont_name | Yes | Normalized field sourced from name. |
| _ont_source | Module that populated this node's ontology fields. | |
| _ont_status | Yes | Normalized field sourced from status_phase. |
Relationships
(:KubernetesCluster)-[:RESOURCE]->(:KubernetesNamespace): Links a cluster to one of its namespaces.(:KubernetesCronJob)-[:WORKLOAD_PARENT]->(:KubernetesNamespace): Links a cron job to the namespace that owns it.(:KubernetesDaemonSet)-[:WORKLOAD_PARENT]->(:KubernetesNamespace): Links a daemon set to the namespace that owns it.(:KubernetesDeployment)-[:WORKLOAD_PARENT]->(:KubernetesNamespace): Links a deployment to the namespace that owns it.(:KubernetesJob)-[:WORKLOAD_PARENT]->(:KubernetesNamespace): Links a job to the namespace that owns it.(:KubernetesNamespace)-[:CONTAINS]->(:KubernetesContainer): Links a namespace to a container it contains.(:KubernetesNamespace)-[:CONTAINS]->(:KubernetesGateway): Links a namespace to a gateway it contains.(:KubernetesNamespace)-[:CONTAINS]->(:KubernetesHTTPRoute): Links a namespace to a HTTP route it contains.(:KubernetesNamespace)-[:CONTAINS]->(:KubernetesIngress): Links a namespace to an ingress it contains.(:KubernetesNamespace)-[:CONTAINS]->(:KubernetesNetworkPolicy): Links a namespace to a network policy it contains.(:KubernetesNamespace)-[:CONTAINS]->(:KubernetesPod): Links a namespace to a pod it contains.(:KubernetesNamespace)-[:CONTAINS]->(:KubernetesRole): Links a namespace to a role it contains.(:KubernetesNamespace)-[:CONTAINS]->(:KubernetesRoleBinding): Links a namespace to a role binding it contains.(:KubernetesNamespace)-[:CONTAINS]->(:KubernetesSecret): Links a namespace to a secret it contains.(:KubernetesNamespace)-[:CONTAINS]->(:KubernetesService): Links a namespace to a service it contains.(:KubernetesNamespace)-[:CONTAINS]->(:KubernetesServiceAccount): Links a namespace to a service account it contains.(:KubernetesNamespace)-[:WORKLOAD_PARENT]->(:KubernetesCluster): Links a namespace to the cluster it belongs to.(:KubernetesPod)-[:WORKLOAD_PARENT]->(:KubernetesNamespace): Links a pod to the namespace that owns it.(:KubernetesStatefulSet)-[:WORKLOAD_PARENT]->(:KubernetesNamespace): Links a stateful set to the namespace that owns it.
KubernetesNetworkPolicy
A Kubernetes network policy that controls pod traffic.
Properties
| Field | Index | Description |
|---|---|---|
| id | Yes | UID of the network policy. |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| cluster_name | Yes | Name of the Kubernetes cluster where this network policy is defined. |
| creation_timestamp | Timestamp of the creation time of the network policy. | |
| deletion_timestamp | Timestamp of the deletion time of the network policy. | |
| egress_rules | The spec.egress rule set (to-peers and ports), stored as a JSON-encoded string. |
|
| ingress_rules | The spec.ingress rule set (from-peers and ports), stored as a JSON-encoded string. |
|
| name | Yes | Name of the network policy. |
| namespace | Yes | The Kubernetes namespace where this network policy is defined. |
| pod_selector | The spec.podSelector selecting the pods this policy applies to, stored as a JSON-encoded {match_labels, match_expressions}. An empty selector selects every pod in the namespace. |
|
| policy_types | List of policy types the policy governs, e.g. ['Ingress'], ['Ingress', 'Egress']. |
|
| restricts_egress | true when Egress is in policy_types: the selected pods are default-deny for egress except for what egress_rules admit. |
|
| restricts_ingress | true when Ingress is in policy_types: the selected pods are default-deny for ingress except for what ingress_rules admit. |
Relationships
(:KubernetesCluster)-[:RESOURCE]->(:KubernetesNetworkPolicy): Links a cluster to one of its network policies.(:KubernetesNamespace)-[:CONTAINS]->(:KubernetesNetworkPolicy): Links a namespace to a network policy it contains.(:KubernetesNetworkPolicy)-[:APPLIES_TO]->(:KubernetesPod): Links a network policy to a pod its selector matches.
KubernetesNode
A worker node registered with a Kubernetes cluster.
Properties
| Field | Index | Description |
|---|---|---|
| id | Yes | Identifier for the node derived from cluster name and node name (e.g. my-cluster/my-node). |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| architecture | Raw CPU architecture as reported by the node (e.g. amd64, arm64). |
|
| architecture_normalized | Canonical CPU architecture after normalization (e.g. x86_64 → amd64, aarch64 → arm64). |
|
| cluster_name | Yes | Name of the Kubernetes cluster this node belongs to. |
| container_runtime_version | Container runtime and version (e.g. containerd://1.7.0). |
|
| instance_id | Yes | EC2 instance id parsed from provider_id for EKS nodes (e.g. i-0123456789abcdef0); null for non-AWS providers. |
| kernel_version | Kernel version of the node (e.g. 5.15.0-1034-aws). |
|
| kubelet_version | Version of the kubelet running on the node (e.g. v1.27.1). |
|
| name | Yes | Name of the Kubernetes node. |
| os | Operating system of the node (e.g. linux). |
|
| os_image | Human-readable OS image name (e.g. Ubuntu 22.04.3 LTS). |
|
| provider_id | Cloud provider instance reference from the node's spec.providerID (e.g. EKS: aws:///us-east-1a/i-0123456789abcdef0). |
Relationships
(:KubernetesCluster)-[:RESOURCE]->(:KubernetesNode): Links a cluster to one of its nodes.(:KubernetesNode)-[:IS_INSTANCE]->(:AWSEC2Instance): Links a node to the EC2 instance backing it.(:KubernetesPod)-[:RUNS_ON]->(:KubernetesNode): Links a pod to the node it is scheduled on.
KubernetesOIDCProvider
An external OIDC identity provider trusted by a Kubernetes cluster.
Ontology Mapping: This node uses the ontology label
IdentityProvider.
Properties
Ontology-generated fields are shown in italics.
| Field | Index | Description |
|---|---|---|
| id | Yes | Identifier for the OIDC Provider derived from cluster name and provider name (e.g. my-cluster/oidc/auth0-provider). |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| client_id | OIDC client ID used for authentication. | |
| cluster_name | Name of the Kubernetes cluster this provider is associated with. | |
| issuer_url | URL of the OIDC issuer (e.g. https://company.auth0.com/). |
|
| k8s_platform | Type of Kubernetes platform managing this OIDC configuration (e.g. eks for AWS EKS, aks for Azure AKS). |
|
| name | Name of the OIDC provider configuration. | |
| status | Status of the OIDC provider configuration (e.g. ACTIVE). |
|
| _ont_enabled | Yes | Normalized field sourced from status. |
| _ont_issuer | Yes | Normalized field sourced from issuer_url. |
| _ont_name | Yes | Normalized field sourced from name. |
| _ont_protocol | Yes | Property generated by the ontology mapping. |
| _ont_source | Module that populated this node's ontology fields. |
Relationships
(:KubernetesCluster)-[:RESOURCE]->(:KubernetesOIDCProvider): Links a cluster to one of its OIDC providers.(:KubernetesCluster)-[:TRUSTS]->(:KubernetesOIDCProvider): Links a cluster to an OIDC provider it accepts tokens from.
KubernetesPod
A Kubernetes pod and its workload security configuration.
Ontology Mapping: This node uses the ontology label
ComputePod.
Properties
Ontology-generated fields are shown in italics.
| Field | Index | Description |
|---|---|---|
| id | Yes | UID of the Kubernetes pod. |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| architecture_normalized | Canonical CPU architecture derived from the scheduled node when available (e.g. amd64, arm64). |
|
| automount_service_account_token | Pod-level override for whether a service account token is automatically mounted. Derived from pod.spec.automount_service_account_token. |
|
| cluster_name | Yes | Name of the Kubernetes cluster where this pod is deployed. |
| creation_timestamp | Timestamp of the creation time of the Kubernetes pod. | |
| deletion_timestamp | Timestamp of the deletion time of the Kubernetes pod. | |
| exposed_internet | Yes | Set by analysis job. true if this pod is reachable from an internet-facing load balancer. |
| exposed_internet_type | Yes | How the pod is exposed. Always lb. |
| host_ipc | Whether the pod shares the host IPC namespace. Derived from pod.spec.host_ipc. |
|
| host_network | Yes | Whether the pod shares the host network namespace. Derived from pod.spec.host_network. |
| host_path_volume_paths | List of host filesystem paths mounted via hostPath pod volumes. Derived from pod.spec.volumes[].host_path.path. |
|
| host_pid | Whether the pod shares the host PID namespace. Derived from pod.spec.host_pid. |
|
| labels | Labels are key-value pairs contained in the PodSpec and fetched from pod.metadata.labels. Stored as a JSON-encoded string. |
|
| name | Yes | Name of the Kubernetes pod. |
| namespace | Yes | The Kubernetes namespace where this pod is deployed. |
| node | Name of the Kubernetes node where this pod is currently scheduled and running. Fetched from pod.spec.node_name. |
|
| seccomp_profile_type | Pod-level seccomp profile type when set, such as RuntimeDefault. Derived from pod.spec.security_context.seccomp_profile.type. |
|
| service_account_name | Name of the ServiceAccount used by the pod. Derived from pod.spec.service_account_name and defaults to default when unset. |
|
| status_phase | The phase of a Pod is a simple, high-level summary of where the Pod is in its lifecycle. | |
| _ont_name | Yes | Normalized field sourced from name. |
| _ont_namespace | Yes | Normalized field sourced from namespace. |
| _ont_node | Yes | Normalized field sourced from node. |
| _ont_source | Module that populated this node's ontology fields. | |
| _ont_status | Yes | Normalized field sourced from status_phase. |
Relationships
(:AWSLoadBalancerV2)-[:EXPOSE]->(:KubernetesPod): generated by analysis jobKubernetes LoadBalancer to pod EXPOSE relationships.Properties:
Field Description exposure_type Property generated by analysis job: Kubernetes LoadBalancer to pod EXPOSE relationships.
(:KubernetesCluster)-[:RESOURCE]->(:KubernetesPod): Links a cluster to a pod running in it.(:KubernetesContainer)-[:WORKLOAD_PARENT]->(:KubernetesPod): Links a container to the pod it runs in.(:KubernetesNamespace)-[:CONTAINS]->(:KubernetesPod): Links a namespace to a pod it contains.(:KubernetesNetworkPolicy)-[:APPLIES_TO]->(:KubernetesPod): Links a network policy to a pod its selector matches.(:KubernetesPod)-[:CONTAINS]->(:KubernetesContainer): Links a pod to a container it runs.(:KubernetesPod)-[:OWNED_BY]->(:KubernetesReplicaSet)(:KubernetesPod)-[:RUNS_AS]->(:KubernetesServiceAccount): Links a pod to the identity it runs as.(:KubernetesPod)-[:RUNS_ON]->(:KubernetesNode): Links a pod to the node it is scheduled on.(:KubernetesPod)-[:USES_SECRET]->(:KubernetesSecret): Links a pod to a secret it consumes.Properties:
Field Description mount_method How the pod consumes the secret: volume, environment, or both.
(:KubernetesPod)-[:USES_SECRET_ENV]->(:KubernetesSecret): Links a pod to a secret it reads through environment variables.(:KubernetesPod)-[:USES_SECRET_VOLUME]->(:KubernetesSecret): Links a pod to a secret it mounts as a volume.(:KubernetesPod)-[:USES_SERVICE_ACCOUNT]->(:KubernetesServiceAccount): Links a pod to the service account it is configured with.(:KubernetesPod)-[:WORKLOAD_PARENT]->(:KubernetesDaemonSet)(:KubernetesPod)-[:WORKLOAD_PARENT]->(:KubernetesDeployment)(:KubernetesPod)-[:WORKLOAD_PARENT]->(:KubernetesJob)(:KubernetesPod)-[:WORKLOAD_PARENT]->(:KubernetesNamespace): Links a pod to the namespace that owns it.(:KubernetesPod)-[:WORKLOAD_PARENT]->(:KubernetesStatefulSet)(:KubernetesService)-[:TARGETS]->(:KubernetesPod): Links a service to a pod it sends traffic to.
KubernetesReplicaSet
A Kubernetes ReplicaSet that maintains a stable set of pod replicas.
Properties
| Field | Index | Description |
|---|---|---|
| id | Yes | UID of the Kubernetes ReplicaSet. |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| cluster_name | Yes | Name of the Kubernetes cluster containing the ReplicaSet. |
| creation_timestamp | Timestamp when the Kubernetes ReplicaSet was created. | |
| deletion_timestamp | Timestamp when the Kubernetes ReplicaSet was marked for deletion. | |
| labels | Metadata labels on the ReplicaSet, stored as a JSON-encoded string. | |
| name | Yes | Name of the Kubernetes ReplicaSet. |
| namespace | Yes | Kubernetes namespace containing the ReplicaSet. |
| ready_replicas | Number of pod replicas that are ready. | |
| replicas | Number of pod replicas currently maintained. |
Relationships
(:KubernetesCluster)-[:RESOURCE]->(:KubernetesReplicaSet): Links a cluster to one of its replica sets.(:KubernetesPod)-[:OWNED_BY]->(:KubernetesReplicaSet)(:KubernetesReplicaSet)-[:OWNED_BY]->(:KubernetesDeployment): Links a replica set to the deployment that manages it.
KubernetesRole
A namespace-scoped Kubernetes RBAC role.
Ontology Mapping: This node uses the ontology label
PermissionRole.
Properties
Ontology-generated fields are shown in italics.
| Field | Index | Description |
|---|---|---|
| id | Yes | Identifier for the Role derived from cluster_name, namespace and name (e.g. my-cluster/default/pod-reader). |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| api_groups | List of API groups that this Role grants access to (e.g. ["core", "apps"]). |
|
| creation_timestamp | Timestamp of the creation time of the Kubernetes Role. | |
| name | Name of the Kubernetes Role. | |
| namespace | The Kubernetes namespace where this Role is deployed. | |
| resource_version | The resource version of the Role for optimistic concurrency control. | |
| resources | List of resources that this Role grants access to (e.g. ["pods", "services"]). |
|
| uid | UID of the Kubernetes Role. | |
| verbs | List of verbs/actions that this Role allows (e.g. ["get", "list", "create"]). |
|
| _ont_name | Yes | Normalized field sourced from name. |
| _ont_scope | Yes | Property generated by the ontology mapping. |
| _ont_source | Module that populated this node's ontology fields. |
Relationships
(:KubernetesCluster)-[:RESOURCE]->(:KubernetesRole): Links a cluster to one of its roles.(:KubernetesNamespace)-[:CONTAINS]->(:KubernetesRole): Links a namespace to a role it contains.(:KubernetesRoleBinding)-[:ROLE_REF]->(:KubernetesRole): Links a role binding to the role it grants.
KubernetesRoleBinding
A namespace-scoped binding between RBAC subjects and a role.
Properties
| Field | Index | Description |
|---|---|---|
| id | Yes | Identifier for the RoleBinding derived from cluster_name, namespace and name (e.g. my-cluster/default/my-binding). |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| creation_timestamp | Timestamp of the creation time of the Kubernetes RoleBinding. | |
| group_ids | Identifiers of bound group subjects. | |
| name | Name of the Kubernetes RoleBinding. | |
| namespace | The Kubernetes namespace where this RoleBinding is deployed. | |
| resource_version | The resource version of the RoleBinding for optimistic concurrency control. | |
| role_id | Identifier for the target Role (used for relationship matching). | |
| role_kind | Kind of the role reference (e.g. Role or ClusterRole). |
|
| role_name | Name of the Role that this RoleBinding references. | |
| service_account_ids | Identifiers of bound service account subjects. | |
| uid | UID of the Kubernetes RoleBinding. | |
| user_ids | Identifiers of bound user subjects. |
Relationships
(:KubernetesCluster)-[:RESOURCE]->(:KubernetesRoleBinding): Links a cluster to one of its role bindings.(:KubernetesNamespace)-[:CONTAINS]->(:KubernetesRoleBinding): Links a namespace to a role binding it contains.(:KubernetesRoleBinding)-[:ROLE_REF]->(:KubernetesRole): Links a role binding to the role it grants.(:KubernetesRoleBinding)-[:SUBJECT]->(:KubernetesGroup): Links a role binding to a group it grants its role to.(:KubernetesRoleBinding)-[:SUBJECT]->(:KubernetesServiceAccount): Links a role binding to a service account it grants its role to.(:KubernetesRoleBinding)-[:SUBJECT]->(:KubernetesUser): Links a role binding to a user it grants its role to.
KubernetesSecret
Metadata for a Kubernetes secret without its secret content.
Ontology Mapping: This node uses the ontology label
Secret.
Properties
Ontology-generated fields are shown in italics.
| Field | Index | Description |
|---|---|---|
| id | Yes | UID of the kubernetes secret. |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| cluster_name | Yes | Name of the Kubernetes cluster where this secret is deployed. |
| composite_id | Yes | Cluster, namespace, and name identifier used for matching. |
| creation_timestamp | Timestamp of the creation time of the kubernetes secret. | |
| deletion_timestamp | Timestamp of the deletion time of the kubernetes secret. | |
| name | Yes | Name of the kubernetes secret. |
| namespace | Yes | The Kubernetes namespace where this secret is deployed. |
| owner_references | References to objects that own this secret. Useful if a secret is an ExternalSecret. Fetched from secret.metadata.owner_references. Stored as a JSON-encoded string. |
|
| type | Type of kubernetes secret (e.g. Opaque). |
|
| _ont_created_at | Yes | Normalized field sourced from creation_timestamp. |
| _ont_name | Yes | Normalized field sourced from name. |
| _ont_source | Module that populated this node's ontology fields. |
Relationships
(:KubernetesCluster)-[:RESOURCE]->(:KubernetesSecret): Links a cluster to one of its secrets.(:KubernetesNamespace)-[:CONTAINS]->(:KubernetesSecret): Links a namespace to a secret it contains.(:KubernetesPod)-[:USES_SECRET]->(:KubernetesSecret): Links a pod to a secret it consumes.Properties:
Field Description mount_method How the pod consumes the secret: volume, environment, or both.
(:KubernetesPod)-[:USES_SECRET_ENV]->(:KubernetesSecret): Links a pod to a secret it reads through environment variables.(:KubernetesPod)-[:USES_SECRET_VOLUME]->(:KubernetesSecret): Links a pod to a secret it mounts as a volume.
KubernetesService
A Kubernetes service that exposes a set of pods.
Properties
| Field | Index | Description |
|---|---|---|
| id | Yes | UID of the kubernetes service. |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| cluster_ip | The internal IP address assigned to the Kubernetes service within the cluster. | |
| cluster_name | Yes | Name of the Kubernetes cluster where this service is deployed. |
| creation_timestamp | Timestamp of the creation time of the kubernetes service. | |
| deletion_timestamp | Timestamp of the deletion time of the kubernetes service. | |
| exposed_internet | Yes | True when the service, or an ingress targeting it, uses an internet-facing load balancer. False otherwise. |
| exposed_internet_type | Yes | How it is exposed. Always lb. |
| load_balancer_ingress | The list of load balancer ingress points, typically containing the hostname and IP. Stored as a JSON-encoded string. | |
| load_balancer_ip | IP of the load balancer when service type is LoadBalancer. |
|
| name | Yes | Name of the kubernetes service. |
| namespace | Yes | The Kubernetes namespace where this service is deployed. |
| qualified_name | Yes | <namespace>/<name> identifier used to match the service from cross-namespace references such as HTTPRoute.spec.rules[].backendRefs. |
| selector | Labels used by the service to select pods. Fetched from service.spec.selector. Stored as a JSON-encoded string. |
|
| type | Yes | Type of kubernetes service e.g. ClusterIP. |
Relationships
(:KubernetesCluster)-[:RESOURCE]->(:KubernetesService): Links a cluster to one of its services.(:KubernetesHTTPRoute)-[:TARGETS]->(:KubernetesService): Links an HTTP route to a service it forwards traffic to.(:KubernetesIngress)-[:TARGETS]->(:KubernetesService): Links an ingress to a service it routes traffic to.(:KubernetesNamespace)-[:CONTAINS]->(:KubernetesService): Links a namespace to a service it contains.(:KubernetesService)-[:TARGETS]->(:KubernetesPod): Links a service to a pod it sends traffic to.(:KubernetesService)-[:USES_LOAD_BALANCER]->(:AWSLoadBalancerV2): Links a service of typeLoadBalancerto the AWS load balancer that exposes it, matching the service'sstatus.loadBalancer.ingress[].hostnameagainstAWSLoadBalancerV2.dnsname. Both sides are lowercased at ingestion, since AWS preserves the load balancer name's case in the DNS name it hands to the in-cluster controller.
KubernetesServiceAccount
A service account used by workloads in a Kubernetes cluster.
Ontology Mapping: This node uses the ontology label
ServiceAccount.
Properties
Ontology-generated fields are shown in italics.
| Field | Index | Description |
|---|---|---|
| id | Yes | Identifier for the ServiceAccount derived from cluster_name, namespace and name (e.g. my-cluster/default/my-service-account). |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| automount_service_account_token | Whether the ServiceAccount token should be automatically mounted in pods. | |
| aws_role_arn | ARN from the IRSA annotation eks.amazonaws.com/role-arn, when present. Used to link the ServiceAccount to an AWSRole. |
|
| creation_timestamp | Timestamp of the creation time of the Kubernetes ServiceAccount. | |
| gcp_service_account | Email from the GKE Workload Identity annotation iam.gke.io/gcp-service-account, when present. Used to link the ServiceAccount to a GCPServiceAccount. |
|
| name | Name of the Kubernetes ServiceAccount. | |
| namespace | The Kubernetes namespace where this ServiceAccount is deployed. | |
| resource_version | The resource version of the ServiceAccount for optimistic concurrency control. | |
| uid | UID of the Kubernetes ServiceAccount. | |
| _ont_name | Yes | Normalized field sourced from name. |
| _ont_source | Module that populated this node's ontology fields. |
Relationships
(:KubernetesCluster)-[:RESOURCE]->(:KubernetesServiceAccount): Links a cluster to one of its service accounts.(:KubernetesClusterRoleBinding)-[:SUBJECT]->(:KubernetesServiceAccount): Links a cluster role binding to a service account it grants its role to.(:KubernetesNamespace)-[:CONTAINS]->(:KubernetesServiceAccount): Links a namespace to a service account it contains.(:KubernetesPod)-[:RUNS_AS]->(:KubernetesServiceAccount): Links a pod to the identity it runs as.(:KubernetesPod)-[:USES_SERVICE_ACCOUNT]->(:KubernetesServiceAccount): Links a pod to the service account it is configured with.(:KubernetesRoleBinding)-[:SUBJECT]->(:KubernetesServiceAccount): Links a role binding to a service account it grants its role to.(:KubernetesServiceAccount)-[:ASSUMES_ROLE]->(:AWSRole): Links a service account to the AWS IAM role it can assume through IRSA.(:KubernetesServiceAccount)-[:WORKLOAD_IDENTITY_BINDING]->(:GCPServiceAccount): Links a service account to the Google Cloud service account it impersonates through Workload Identity.
KubernetesStatefulSet
A Kubernetes StatefulSet that manages pods with stable identities.
Ontology Mapping: This node uses the ontology label
ComputeService.
Properties
Ontology-generated fields are shown in italics.
| Field | Index | Description |
|---|---|---|
| id | Yes | UID of the Kubernetes StatefulSet. |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| cluster_name | Yes | Name of the Kubernetes cluster containing the StatefulSet. |
| creation_timestamp | Timestamp when the Kubernetes StatefulSet was created. | |
| deletion_timestamp | Timestamp when the Kubernetes StatefulSet was marked for deletion. | |
| labels | Metadata labels on the StatefulSet, stored as a JSON-encoded string. | |
| name | Yes | Name of the Kubernetes StatefulSet. |
| namespace | Yes | Kubernetes namespace containing the StatefulSet. |
| ready_replicas | Number of pod replicas that are ready. | |
| replicas | Desired number of pod replicas. | |
| service_name | Name of the governing Kubernetes Service. | |
| _ont_name | Yes | Normalized field sourced from name. |
| _ont_source | Module that populated this node's ontology fields. |
Relationships
(:KubernetesCluster)-[:RESOURCE]->(:KubernetesStatefulSet): Links a cluster to one of its stateful sets.(:KubernetesPod)-[:WORKLOAD_PARENT]->(:KubernetesStatefulSet)(:KubernetesStatefulSet)-[:WORKLOAD_PARENT]->(:KubernetesNamespace): Links a stateful set to the namespace that owns it.
KubernetesUser
A user identity referenced by Kubernetes RBAC.
Ontology Mapping: This node uses the ontology label
UserAccount.
Properties
Ontology-generated fields are shown in italics.
| Field | Index | Description |
|---|---|---|
| id | Yes | Identifier for the user. |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| cluster_name | Name of the cluster this user belongs to. | |
| name | Name of the Kubernetes user. | |
| _ont_source | Module that populated this node's ontology fields. | |
| _ont_username | Yes | Normalized field sourced from name. |
Relationships
(:AWSRole)-[:MAPS_TO]->(:KubernetesUser): Links an AWS IAM role to the Kubernetes user it maps to.(:AWSRootPrincipal)-[:MAPS_TO]->(:KubernetesUser): Links an AWS account root principal to the Kubernetes user it maps to.(:AWSUser)-[:MAPS_TO]->(:KubernetesUser): Links an AWS IAM user to the Kubernetes user it maps to.(:KubernetesCluster)-[:RESOURCE]->(:KubernetesUser): Links a cluster to one of its users.(:KubernetesClusterRoleBinding)-[:SUBJECT]->(:KubernetesUser): Links a cluster role binding to a user it grants its role to.(:KubernetesRoleBinding)-[:SUBJECT]->(:KubernetesUser): Links a role binding to a user it grants its role to.(:OktaUser)-[:MAPS_TO]->(:KubernetesUser): Links an Okta user to the Kubernetes user it maps to.(:User)-[:HAS_ACCOUNT]->(:UserAccount)