---
title: Always know about the dependency of your Pods - here comes SBOM operator for Kubernetes - Codenotary
description: MONITOR & MANAGE THE RISK EXPOSURE OF YOUR APPLICATIONS WITH TRUESBOM®
image: https://codenotary.com/hubfs/Imported_Blog_Media/Blog-Default-General-Feb-10-2023-08-06-57-7409-AM.jpg
---

**$ protect --distro linux --machines 25 --free**

[Start now](https://apps.codenotary.com/linux)

[![cn-logo-black-nobg](https://codenotary.com/hubfs/cn-logo-black-nobg.svg)](https://codenotary.com/)

- Product
  
  #### [![AgentMon Start](https://codenotary.com/hubfs/chub_backup/AgentMon%20Start.svg) **AgentMon Start** See what your AI agents are doing on your machine. TRY NOW →](https://codenotary.com/agentmon-start)
  
  #### [![AgentMon for Enterprise](https://codenotary.com/hubfs/AgentMon%20for%20Enterprise.svg) **AgentMon** Currently monitors more \> 7 million agent interactions/day. TRY NOW →](https://codenotary.com/agentmon)
  
  #### [![AgentX](https://codenotary.com/hubfs/AgentX.svg) **AgentX** Agentic network control middleware. TRY NOW →](https://codenotary.com/agent-network-control)
  
  #### [![Autonomous Security](https://codenotary.com/hubfs/Autonomous%20Security.svg) **Autonomous Security** AI Agents keep your servers secure. TRY NOW →](https://codenotary.com/trust)
- Use Cases
  
  #### [**AI Agent Risk Monitoring** Continuous oversight of autonomous agents across every environment.](https://codenotary.com/use-cases#risk)
  
  #### [**Autonomous Security Operations** Self-healing defenses that detect, contain, and remediate threats.](https://codenotary.com/use-cases#agentops)
  
  #### [**AI Coding Governance & Performance Monitoring** AI-generated code reviewed, tracked, and held to quality standards.](https://codenotary.com/use-cases#performance)
  
  #### [**AI Tool Cost & Usage Optimization** Spend and consumption optimized across every AI service in use.](https://codenotary.com/use-cases#cost)
  
  #### [**AI Tool Security & Policy Enforcement** Approved AI usage enforced with guardrails and policy controls.](https://codenotary.com/use-cases#security#security)
  
  #### [**Shadow AI Governance** Unsanctioned AI tools discovered, surfaced, and brought under control.](https://codenotary.com/use-cases#shadowit)
- [Blog](https://codenotary.com/blog)
- [Press](https://codenotary.com/press)
- Resources
  
  #### [**Integrations** Connect with your favorite tools and platforms. LEARN MORE →](https://codenotary.com/integrations)
  
  #### [**Support** Get help from our dedicated support team. GET HELP →](https://support.codenotary.com)
  
  #### [**Success Stories** Read how customers achieve their goals. READ MORE →](https://codenotary.com/success)
  
  #### [**Learn** Access documentation and learning resources. EXPLORE →](https://codenotary.com/learn)

[Login](https://apps.codenotary.com/auth/login)

[All posts](https://codenotary.com/blog/all)

 May 17, 2022

# Always know about the dependency of your Pods – here comes SBOM operator for Kubernetes

 By  [Dennis](https://codenotary.com/blog/author/dennis)  ·   3 minute read

Some months ago Christian Kotzbauer started a community project called SBOM operator that created SBOMs based on the container images used by the Pods and stored them in a Git repository. His main intentions were to have a Kubernetes-native way to generate and store Software Bill of Materials for all running container.

Thinking about the importance of storing a tamperproof Bill of Material and having a way to automatically relate the SBOM with the unique container image ID, he decided to extend the SBOM operator to Codenotary CAS and Codenotary Cloud.

> “I am pleased to contribute to the wider adoption and use of SBOMs with the Codenotary integration in my Kubernetes operator.” said Christian, “especially the additional security, timestamp and search capabilities across the infrastructure were key to developing the extension.”
> 
> Christian Kotzbauer, https://github.com/ckotzbauer/sbom-operator

## What do you gain as a DevOps engineer?

For sure you still remember the last couple of months with plenty of requests, if there are any vulnerable Log4J (Log4Shell) or spring-webmvc (Spring4Shell) versions running in the infrastructure. Just checking the Git repositories source code or image scanning doesn’t really cut it. You need to know if these components are already in your environment and you need to know it immediately.

Codenotary Cloud and CAS make it very easy to gather the SBOM information and not simply store it, but store them auditable and fully searchable.

**Example Codenotary Cloud:**

```
vcn authenticate --bom-what-includes --name log4j-core --version "<2.15.0"
```

![](https://codenotary.com/hs-fs/hubfs/Imported_Blog_Media/image-1-1024x263-1.png?width=1024&height=263&name=image-1-1024x263-1.png)

Based on the included in information, you can simply check what is currently using the dependency:

```
vcn authenticate --hash 6bd1bad7c9c664580428c35fe354a5f92dc87d6a24db566a5421a1abdf5ed733
```

![](https://codenotary.com/hs-fs/hubfs/Imported_Blog_Media/image-2-1024x520-1.png?width=1024&height=520&name=image-2-1024x520-1.png)

or use the dashboard

![](https://codenotary.com/hs-fs/hubfs/Imported_Blog_Media/image-3-1024x1000-1.png?width=1024&height=1000&name=image-3-1024x1000-1.png)

The SBOM viewer in the Codenotary Cloud dashboard allows to search and filter dependencies and immediately detect untrusted or unwanted components – Log4J-Core component in the example below.

## Installation of the Operator in Kubernetes

Create a secret for the API Key:

```
kubectl create secret generic SBOM_JOB_VCN_LC_API_KEY --from-literal=secret=<Your Codenotary Cloud API Key>
```

or using CAS:

```
kubectl create secret generic SBOM_JOB_CAS_API_KEY --from-literal=secret=<Your cas.Codenotary.com API Key>
```

deployment.yaml for Codenotary Cloud (make sure to change SBOM\_JOB\_VCN\_LC\_HOST value):

```
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/name: sbom-operator
  name: sbom-operator
  namespace: default
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: sbom-operator
  template:
    metadata:
      labels:
        app.kubernetes.io/name: sbom-operator
    spec:
      containers:
      - image: Codenotary/sbom-operator:0.10.0
        name: operator
        env:
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: POD_UID
          valueFrom:
            fieldRef:
              fieldPath: metadata.uid
        # Free account
        # - name: SBOM_JOB_CAS_API_KEY
        #   value: ""
        - name: SBOM_JOB_VCN_LC_HOST
          value: "YourCNC.Codenotary.com"
        - name: SBOM_JOB_VCN_LC_API_KEY
          valueFrom:
             secretKeyRef:
               name: cncapikey
               key: secret
        args:
          # example values
          - --cron="0 6 * * *"
          - --job-image=Codenotary/sbom-operator:vcn-0.11.0
          #- --pod-label-selector=sbom-operator\=true
        ports:
        - containerPort: 8080
          name: http
          protocol: TCP
        securityContext:
          capabilities:
            drop:
            - ALL
          privileged: false
          readOnlyRootFilesystem: true
          runAsNonRoot: true
          runAsUser: 101
          seccompProfile:
            type: RuntimeDefault
        resources:
          limits:
            cpu: 500m
            memory: 500Mi
          requests:
            cpu: 100m
            memory: 100Mi
        livenessProbe:
          timeoutSeconds: 3
          httpGet:
            path: "/health"
            port: 8080
        readinessProbe:
          timeoutSeconds: 3
          httpGet:
            path: "/health"
            port: 8080
      securityContext:
        fsGroup: 101
      serviceAccountName: sbom-operator
```

or deployment.yaml for CAS

```
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/name: sbom-operator
  name: sbom-operator
  namespace: default
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: sbom-operator
  template:
    metadata:
      labels:
        app.kubernetes.io/name: sbom-operator
    spec:
      containers:
      - image: Codenotary/sbom-operator:0.10.0
        name: operator
        env:
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: POD_UID
          valueFrom:
            fieldRef:
              fieldPath: metadata.uid
        - name: SBOM_JOB_CAS_API_KEY
          valueFrom:
             secretKeyRef:
               name: casapikey
               key: secret
        args:
          # example values
          - --cron="0 6 * * *"
          - --job-image=Codenotary/sbom-operator:cas-0.11.0
          #- --pod-label-selector=sbom-operator\=true
        ports:
        - containerPort: 8080
          name: http
          protocol: TCP
        securityContext:
          capabilities:
            drop:
            - ALL
          privileged: false
          readOnlyRootFilesystem: true
          runAsNonRoot: true
          runAsUser: 101
          seccompProfile:
            type: RuntimeDefault
        resources:
          limits:
            cpu: 500m
            memory: 500Mi
          requests:
            cpu: 100m
            memory: 100Mi
        livenessProbe:
          timeoutSeconds: 3
          httpGet:
            path: "/health"
            port: 8080
        readinessProbe:
          timeoutSeconds: 3
          httpGet:
            path: "/health"
            port: 8080
      securityContext:
        fsGroup: 101
      serviceAccountName: sbom-operator
```

and the rbac.yaml

```
apiVersion: v1
kind: ServiceAccount
metadata:
  name: sbom-operator
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: sbom-operator
rules:
- apiGroups:
  - ""
  resources:
  - pods
  - namespaces
  verbs:
  - list
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - get
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - get
  - update
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - get
  - create
  - delete
- apiGroups:
  - batch
  resources:
  - jobs
  verbs:
  - get
  - create
  - delete
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: sbom-operator
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: sbom-operator
subjects:
- kind: ServiceAccount
  name: sbom-operator
  namespace: default
```

Install everything using kubectl:

```
kubectl apply -f deployment.yaml rbac.yaml
```

After the deployment has been completed, the cron job (based on the configuration in the deployment.yaml) will detect the running images, generate a Software Bill of Materials for each container image and notarize it in either CAS or Codenotary Cloud.

**You are all set!**

[![Share on twitter](https://4059529.fs1.hubspotusercontent-na1.net/hub/4059529/hubfs/01-marketplace/twitter-color.png?width=35&height=35&name=twitter-color.png)](https://twitter.com/intent/tweet?original_referer=https://codenotary.com/blog/always-know-the-dependency-of-your-pods-here-comes-sbom-operator-for-kubernetes&utm_medium=social&utm_source=twitter&url=https://codenotary.com/blog/always-know-the-dependency-of-your-pods-here-comes-sbom-operator-for-kubernetes&utm_medium=social&utm_source=twitter&source=tweetbutton&text=) [![Share on facebook](https://4059529.fs1.hubspotusercontent-na1.net/hub/4059529/hubfs/01-marketplace/facebook-color.png?width=35&height=35&name=facebook-color.png)](http://www.facebook.com/share.php?u=https://codenotary.com/blog/always-know-the-dependency-of-your-pods-here-comes-sbom-operator-for-kubernetes&utm_medium=social&utm_source=facebook) [![Share on linkedin](https://4059529.fs1.hubspotusercontent-na1.net/hub/4059529/hubfs/01-marketplace/linkedin-color.png?width=35&height=35&name=linkedin-color.png)](http://www.linkedin.com/shareArticle?mini=true&url=https://codenotary.com/blog/always-know-the-dependency-of-your-pods-here-comes-sbom-operator-for-kubernetes&utm_medium=social&utm_source=linkedin) [![Share on pinterest](https://4059529.fs1.hubspotusercontent-na1.net/hub/4059529/hubfs/pinterest.jpg?width=35&height=35&name=pinterest.jpg)](http://pinterest.com/pin/create/button/?url=https://codenotary.com/blog/always-know-the-dependency-of-your-pods-here-comes-sbom-operator-for-kubernetes&utm_medium=social&utm_source=pinterest&media=)

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Dennis",
    "url" : "https://codenotary.com/blog/author/dennis"
  },
  "dateModified" : "2023-02-14T21:05:22.932Z",
  "datePublished" : "2022-05-17T13:10:08.000Z",
  "headline" : "Always know about the dependency of your Pods - here comes SBOM operator for Kubernetes - Codenotary",
  "image" : [ "https://codenotary.com/hubfs/Imported_Blog_Media/Blog-Default-General-Feb-10-2023-08-06-57-7409-AM.jpg" ],
  "mainEntityOfPage" : {
    "@id" : "https://codenotary.com/blog/always-know-the-dependency-of-your-pods-here-comes-sbom-operator-for-kubernetes",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://codenotary.com/hubfs/logo-light.svg"
    },
    "name" : "Codenotary, Inc."
  }
}
```

```json
{
  "@context" : "http://schema.org",
  "@type" : "Article",
  "author" : {
    "@type" : "Person",
    "name" : [ "Dennis" ],
    "url" : "https://codenotary.com/blog/author/dennis"
  },
  "datePublished" : "2022-05-17T13:10:08+0000",
  "description" : "MONITOR & MANAGE THE RISK EXPOSURE OF YOUR APPLICATIONS WITH TRUESBOM®",
  "headline" : "Always know about the dependency of your Pods &ndash; here comes SBOM operator for Kubernetes",
  "image" : "https://23873599.fs1.hubspotusercontent-na1.net/hubfs/23873599/Imported_Blog_Media/Blog-Default-General-Feb-10-2023-08-06-57-7409-AM.jpg",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://cdn2.hubspot.net/hubfs/23873599/logo-light.svg"
    },
    "name" : ""
  },
  "url" : "https://codenotary.com/blog/always-know-the-dependency-of-your-pods-here-comes-sbom-operator-for-kubernetes"
}
```