From 3fb0333b02a1a07ceb2f061be884ecffb3c360dd Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Tue, 8 Sep 2026 11:59:19 +0200 Subject: [PATCH 1/2] Remove telemetry integration in the operator Signed-off-by: Jannik Hollenbach --- documentation/docs/11-telemetry.md | 8 ++ .../docs/contributing/local-deployment.md | 6 - .../docs/contributing/project-management.md | 5 - operator/docs/README.ArtifactHub.md | 1 - operator/internal/telemetry/telemetry.go | 123 ------------------ operator/main.go | 5 - operator/templates/NOTES.txt | 10 -- operator/templates/manager/manager.yaml | 2 - .../__snapshot__/operator_test.yaml.snap | 8 +- operator/values.yaml | 3 - 10 files changed, 10 insertions(+), 161 deletions(-) delete mode 100644 operator/internal/telemetry/telemetry.go diff --git a/documentation/docs/11-telemetry.md b/documentation/docs/11-telemetry.md index e259a5f79f..4aeb3c7f0d 100644 --- a/documentation/docs/11-telemetry.md +++ b/documentation/docs/11-telemetry.md @@ -7,6 +7,14 @@ sidebar_label: Telemetry title: "secureCodeBox Telemetry Data" --- +:::warning Telemetry removed in secureCodeBox 5.9.0 +Telemetry collection was removed from the secureCodeBox Operator in release 5.9.0. The limited use of the collected data did not justify continued data collection or the effort of maintaining the telemetry backend. + +The telemetry backend is being shut down and the DNS record for `telemetry.securecodebox.io` will be removed. secureCodeBox operators older than 5.9.0 with telemetry enabled will continue attempting to submit telemetry every 24 hours and log a failed submission after the DNS record is removed. This does not affect scans or the operator's normal operation. Upgrade to 5.9.0 or later to prevent the attempted requests. + +The remaining content on this page is retained temporarily as historical documentation and will be removed in a future release. +::: + The secureCodeBox Operator collects and submits anonymized data to give the development team a vague overview on how much the secureCodeBox is actually used. ## Datapoints Collected: diff --git a/documentation/docs/contributing/local-deployment.md b/documentation/docs/contributing/local-deployment.md index 6bbde9ddd4..033fd74cc4 100644 --- a/documentation/docs/contributing/local-deployment.md +++ b/documentation/docs/contributing/local-deployment.md @@ -163,12 +163,6 @@ secureCodeBox Operator Deployed 🚀 The operator can orchestrate the execution of various security scanning tools inside of your cluster. You can find a list of all officially supported scanners here: https://www.securecodebox.io/ The website also lists other integrations, like persisting scan results to DefectDojo or Elasticsearch. - -The operator send out regular telemetry pings to a central service. -This lets us, the secureCodeBox team, get a grasp on how much the secureCodeBox is used. -The submitted data is chosen to be as anonymous as possible. -You can find a complete report of the data submitted and links to the source-code at: https://www.securecodebox.io/docs/telemetry -The first ping is send one hour after the install, you can prevent this by upgrading the chart and setting `telemetryEnabled` to `false`. ``` :::note diff --git a/documentation/docs/contributing/project-management.md b/documentation/docs/contributing/project-management.md index 627e3cb77e..a766de4081 100644 --- a/documentation/docs/contributing/project-management.md +++ b/documentation/docs/contributing/project-management.md @@ -21,16 +21,11 @@ Under the topic "project management" we describe how we do the organizational st - We have registerded one domain (`securecodebox.io`) which is sponsored by [iteratec][iteratec]. - The DNS cone is managed via [iteratec][iteratec] [Azure Portal](https://portal.azure.com/) by the _admin-team_. - The website [https://www.securecodebox.io] is hosted on [Netlify](https://app.netlify.com/). -- We have a [Hetzner](https://www.hetzner.com/) VM sponsored by [iteratec][iteratec] to host the Helm charts and telemetry server. ### Domains We use these full qualified domain names: -- For our [telemetry](https://www.securecodebox.io/docs/telemetry): - - telemetry.chase.securecodebox.io -> telemetry.securecodebox.io - - Backward compatibility: Was the old address. Old installations use this one. - - telemetry.securecodebox.io -> sky.securecodebox.io - For our main website: - www.securecodebox.io -> docs-securecodebox.netlify.app diff --git a/operator/docs/README.ArtifactHub.md b/operator/docs/README.ArtifactHub.md index b24af0225f..b304d95d2d 100644 --- a/operator/docs/README.ArtifactHub.md +++ b/operator/docs/README.ArtifactHub.md @@ -131,7 +131,6 @@ helm install securecodebox-operator oci://ghcr.io/securecodebox/helm/operator | serviceAccount.annotations | object | `{}` | Annotations of the serviceAccount the operator uses to talk to the k8s api | | serviceAccount.labels | object | `{}` | Labels of the serviceAccount the operator uses to talk to the k8s api | | serviceAccount.name | string | `"securecodebox-operator"` | Name of the serviceAccount the operator uses to talk to the k8s api | -| telemetryEnabled | bool | `true` | The Operator sends anonymous telemetry data, to give the team an overview how much the secureCodeBox is used. Find out more at https://www.securecodebox.io/telemetry | ## Contributing diff --git a/operator/internal/telemetry/telemetry.go b/operator/internal/telemetry/telemetry.go deleted file mode 100644 index a0a7010bb2..0000000000 --- a/operator/internal/telemetry/telemetry.go +++ /dev/null @@ -1,123 +0,0 @@ -// SPDX-FileCopyrightText: the secureCodeBox authors -// -// SPDX-License-Identifier: Apache-2.0 - -package telemetry - -import ( - "bytes" - "context" - "encoding/json" - "net/http" - "os" - "time" - - "sigs.k8s.io/controller-runtime/pkg/client" - - "github.com/go-logr/logr" - executionv1 "github.com/secureCodeBox/secureCodeBox/operator/apis/execution/v1" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" -) - -var telemetryInterval = 24 * time.Hour - -// officialScanTypes contains the list of official secureCodeBox Scan Types. -// Unofficial Scan Types should be reported as "other" to avoid leakage of confidential data via the scan-types name -var officialScanTypes map[string]bool = map[string]bool{ - "amass": true, // deprecated. we'll keep it in this list to still recieve telemetry data from older versions - "cmseek": true, // deprecated. we'll keep it in this list to still recieve telemetry data from older versions - "doggo": true, // deprecated. we'll keep it in this list to still recieve telemetry data from older versions - "ffuf": true, - "git-repo-scanner": true, - "gitleaks": true, - "kube-hunter": true, - "kubeaudit": true, // deprecated. we'll keep it in this list to still recieve telemetry data from older versions - "ncrack": true, - "nikto": true, - "nmap": true, - "nuclei": true, - "screenshooter": true, - "semgrep": true, - "ssh-audit": true, - "ssh-scan": true, // deprecated. we'll keep it in this list to still recieve telemetry data from older versions - "sslyze": true, - "subfinder": true, - "trivy-image": true, - "trivy-filesystem": true, - "trivy-repo": true, - "trivy-sbom-image": true, - "typo3scan": true, // deprecated. we'll keep it in this list to still recieve telemetry data from older versions - "whatweb": true, // deprecated. we'll keep it in this list to still recieve telemetry data from older versions - "wpscan": true, - "zap-baseline-scan": true, // deprecated. we'll keep it in this list to still recieve telemetry data from older versions - "zap-api-scan": true, // deprecated. we'll keep it in this list to still recieve telemetry data from older versions - "zap-full-scan": true, // deprecated. we'll keep it in this list to still recieve telemetry data from older versions - "zap-automation-scan": true, // deprecated. we'll keep it in this list to still recieve telemetry data from older versions - "zap-automation-framework": true, - "zap-advanced-scan": true, // deprecated. we'll keep it in this list to still recieve telemetry data from older versions -} - -// telemetryData submitted by operator -type telemetryData struct { - Version string `json:"version"` - InstalledScanTypes []string `json:"installedScanTypes"` -} - -// Loop Submits Telemetry Data in a regular interval -func Loop(apiClient client.Client, log logr.Logger) { - log.Info("The Operator sends anonymous telemetry data, to give the team an overview how much the secureCodeBox is used. Find out more at https://www.securecodebox.io/docs/telemetry") - - // Wait 1hour to give users time to uninstall / disable telemetry - time.Sleep(1 * time.Hour) - - for { - var version string - if envVersion, ok := os.LookupEnv("VERSION"); ok { - version = envVersion - } else { - version = "unknown" - } - - ctx := context.Background() - - installedScanTypes := map[string]bool{} - var scanTypes executionv1.ScanTypeList - err := apiClient.List(ctx, &scanTypes, client.InNamespace(metav1.NamespaceAll)) - - if err != nil { - log.Error(err, "Failed to list ScanTypes") - } - for _, scanType := range scanTypes.Items { - installedScanTypes[scanType.Name] = true - } - - installedScanTypesList := []string{} - for key := range installedScanTypes { - if _, ok := officialScanTypes[key]; ok { - installedScanTypesList = append(installedScanTypesList, key) - } else { - installedScanTypesList = append(installedScanTypesList, "other") - } - } - - log.Info("Submitting Anonymous Telemetry Data", "Version", version, "InstalledScanTypes", installedScanTypesList) - - reqBody, err := json.Marshal(telemetryData{ - Version: version, - InstalledScanTypes: installedScanTypesList, - }) - - if err != nil { - log.Error(err, "Failed to encode telemetry data to json") - } - response, err := http.Post("https://telemetry.securecodebox.io/v1/submit", "application/json", bytes.NewBuffer(reqBody)) - if err != nil { - log.Error(err, "Failed to send telemetry data") - } - if response != nil { - response.Body.Close() - } - - time.Sleep(telemetryInterval) - } -} diff --git a/operator/main.go b/operator/main.go index a194750a52..2d874ccd28 100644 --- a/operator/main.go +++ b/operator/main.go @@ -25,7 +25,6 @@ import ( executionv1 "github.com/secureCodeBox/secureCodeBox/operator/apis/execution/v1" executioncontrollers "github.com/secureCodeBox/secureCodeBox/operator/controllers/execution" scancontroller "github.com/secureCodeBox/secureCodeBox/operator/controllers/execution/scans" - "github.com/secureCodeBox/secureCodeBox/operator/internal/telemetry" //+kubebuilder:scaffold:imports ) @@ -112,10 +111,6 @@ func main() { os.Exit(1) } - if enabled, ok := os.LookupEnv("TELEMETRY_ENABLED"); ok && enabled == "true" { - go telemetry.Loop(mgr.GetClient(), ctrl.Log.WithName("telemetry")) - } - setupLog.Info("starting manager") if err := mgr.Start(ctrl.SetupSignalHandler()); err != nil { setupLog.Error(err, "problem running manager") diff --git a/operator/templates/NOTES.txt b/operator/templates/NOTES.txt index 1953b9ef6d..45b6bb84c6 100644 --- a/operator/templates/NOTES.txt +++ b/operator/templates/NOTES.txt @@ -8,13 +8,3 @@ secureCodeBox Operator Deployed 🚀 The operator can orchestrate the execution of various security scanning tools inside of your cluster. You can find a list of all officially supported scanners here: https://www.securecodebox.io/ The website also lists other integrations, like persisting scan results to DefectDojo or Elasticsearch. - -{{ if .Values.telemetryEnabled -}} -The operator send out regular telemetry pings to a central service. -This lets us, the secureCodeBox team, get a grasp on how much the secureCodeBox is used. -The submitted data is chosen to be as anonymous as possible. -You can find a complete report of the data submitted and links to the source-code at: https://www.securecodebox.io/docs/telemetry -The first ping is send one hour after the install, you can prevent this by upgrading the chart and setting `telemetryEnabled` to `false`. -{{ else -}} -Telemetry data collection has been disabled. -{{ end -}} diff --git a/operator/templates/manager/manager.yaml b/operator/templates/manager/manager.yaml index a6d62c1adc..ad61913cf4 100644 --- a/operator/templates/manager/manager.yaml +++ b/operator/templates/manager/manager.yaml @@ -66,8 +66,6 @@ spec: readinessProbe: {{- toYaml .Values.probes.readiness | nindent 12 }} env: - - name: TELEMETRY_ENABLED - value: {{ .Values.telemetryEnabled | quote }} - name: VERSION value: {{ .Chart.Version | quote }} # TODO: integrate with cert manager and auto gen a cert for minio diff --git a/operator/tests/__snapshot__/operator_test.yaml.snap b/operator/tests/__snapshot__/operator_test.yaml.snap index 0df925307e..e064256e15 100644 --- a/operator/tests/__snapshot__/operator_test.yaml.snap +++ b/operator/tests/__snapshot__/operator_test.yaml.snap @@ -1,6 +1,6 @@ matches the snapshot: 1: | - raw: "secureCodeBox Operator Deployed \U0001F680\n\nThe operator can orchestrate the execution of various security scanning tools inside of your cluster.\nYou can find a list of all officially supported scanners here: https://www.securecodebox.io/\nThe website also lists other integrations, like persisting scan results to DefectDojo or Elasticsearch.\n\nThe operator send out regular telemetry pings to a central service.\nThis lets us, the secureCodeBox team, get a grasp on how much the secureCodeBox is used.\nThe submitted data is chosen to be as anonymous as possible.\nYou can find a complete report of the data submitted and links to the source-code at: https://www.securecodebox.io/docs/telemetry\nThe first ping is send one hour after the install, you can prevent this by upgrading the chart and setting `telemetryEnabled` to `false`.\n" + raw: "secureCodeBox Operator Deployed \U0001F680\n\nThe operator can orchestrate the execution of various security scanning tools inside of your cluster.\nYou can find a list of all officially supported scanners here: https://www.securecodebox.io/\nThe website also lists other integrations, like persisting scan results to DefectDojo or Elasticsearch.\n" 2: | apiVersion: v1 kind: Service @@ -42,8 +42,6 @@ matches the snapshot: command: - /manager env: - - name: TELEMETRY_ENABLED - value: "true" - name: VERSION value: 0.0.0 - name: S3_USE_SSL @@ -739,7 +737,7 @@ matches the snapshot: name: securecodebox-operator properly-renders-the-service-monitor-when-enabled: 1: | - raw: "secureCodeBox Operator Deployed \U0001F680\n\nThe operator can orchestrate the execution of various security scanning tools inside of your cluster.\nYou can find a list of all officially supported scanners here: https://www.securecodebox.io/\nThe website also lists other integrations, like persisting scan results to DefectDojo or Elasticsearch.\n\nThe operator send out regular telemetry pings to a central service.\nThis lets us, the secureCodeBox team, get a grasp on how much the secureCodeBox is used.\nThe submitted data is chosen to be as anonymous as possible.\nYou can find a complete report of the data submitted and links to the source-code at: https://www.securecodebox.io/docs/telemetry\nThe first ping is send one hour after the install, you can prevent this by upgrading the chart and setting `telemetryEnabled` to `false`.\n" + raw: "secureCodeBox Operator Deployed \U0001F680\n\nThe operator can orchestrate the execution of various security scanning tools inside of your cluster.\nYou can find a list of all officially supported scanners here: https://www.securecodebox.io/\nThe website also lists other integrations, like persisting scan results to DefectDojo or Elasticsearch.\n" 2: | apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor @@ -794,8 +792,6 @@ properly-renders-the-service-monitor-when-enabled: command: - /manager env: - - name: TELEMETRY_ENABLED - value: "true" - name: VERSION value: 0.0.0 - name: S3_USE_SSL diff --git a/operator/values.yaml b/operator/values.yaml index 52ca857fde..0db2942a91 100644 --- a/operator/values.yaml +++ b/operator/values.yaml @@ -6,9 +6,6 @@ # This is a YAML-formatted file. # Declare variables to be passed into your templates. -# telemetryEnabled -- The Operator sends anonymous telemetry data, to give the team an overview how much the secureCodeBox is used. Find out more at https://www.securecodebox.io/telemetry -telemetryEnabled: true - # -- The cluster domain to use when building the in-cluster Minio endpoint (`-minio..svc.`). Override this if your cluster uses a custom domain instead of the Kubernetes default `cluster.local`. clusterDomain: cluster.local From d97c78cd9c1ef9539a56ff77755b63ad15bd437d Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Mon, 7 Sep 2026 16:15:23 +0200 Subject: [PATCH 2/2] Fix now removed internal/ folder mounting into container image build Signed-off-by: Jannik Hollenbach --- operator/Dockerfile | 1 - 1 file changed, 1 deletion(-) diff --git a/operator/Dockerfile b/operator/Dockerfile index 541f384006..bfb0a4c427 100644 --- a/operator/Dockerfile +++ b/operator/Dockerfile @@ -17,7 +17,6 @@ RUN go mod download COPY main.go main.go COPY apis/ apis/ COPY controllers/ controllers/ -COPY internal/ internal/ COPY utils/ utils/ # Build