$ show DataDog/KubeHound
KubeHound is a security analysis tool for Kubernetes clusters that automatically models and computes attack paths. It collects Kubernetes resources (pods, roles, bindings, endpoints, nodes) via a live API or offline dump, transforms them into a property graph stored in JanusGraph (with MongoDB as an intermediate store), and computes privilege escalation and lateral movement paths mapped to MITRE ATT&CK techniques. The system exposes a CLI for local analysis and a gRPC API (KHaaS) for service-oriented deployments, with optional Jupyter notebooks for querying the graph using a custom Gremlin DSL. The architecture is modular: a collector abstraction handles rate-limited streaming from the Kubernetes API; an ingestion pipeline converts raw objects into normalized store models and graph vertices/edges; an edge registry defines over 20 attack types (e.g., PodExec, TokenSteal, ContainerEscape); and a graph builder executes Gremlin traversals to connect vertices into paths. Storage layers use asynchronous writers with micro-batching for high throughput, and an in-memory cache deduplicates identities and roles. Telemetry (Datadog APM, metrics, logs) is integrated throughout. While primarily an application, the repository includes experimental research components (exp/khaudit) for audit reports and MITRE Attack Flow conversion, plus Jupyter notebooks for interactive graph queries, giving it a hybrid character. The codebase demonstrates strong engineering practices: provider interfaces, test mocking, worker pools, retry logic, and comprehensive system tests against real Kind clusters. However, some areas (large cluster optimizations, experimental code, deprecated flags) indicate ongoing evolution and minor technical debt.
The LLM identified 4 files worth highlighting for reuse:
Implements a generic micro-batcher that accumulates items until a batch size or flush interval is reached, then processes them with a configurable number of workers. On failure, it splits the batch in half and retries each half separately. This pattern is reusable in any system requiring high-throughput, fault-tolerant batch writes (e.g., to databases, message queues). The code is clean, well-tested, and isolates batching logic from specific workloads.
Defines the `CollectorClient` interface with a `Stream` method that yields Kubernetes resources (pods, roles, rolebindings, etc.) via callbacks. Implementations include a live K8s API collector (with pagination, rate limiting, and health checks) and a file-based collector for offline data. This abstraction cleanly separates data source from ingestion logic, making it easy to add new collectors or mock for testing. The interface and core logic are reusable for any project needing to stream and process Kubernetes objects.
Provides a typed cache key factory for graph entities (Container, Identity, Node, etc.). Each `Key` struct embeds the entity type and a unique identifier, ensuring type-safe cache operations and preventing key collisions. The pattern of using separate key structs per domain concept is reusable in any caching layer where multiple entity types share a single cache namespace.
Defines the `EdgeBuilder` interface and the `Registry` singleton that collects all edge implementations. Each edge (attack type) is registered at init time, and the builder orchestrates their execution during graph construction. This plugin-like pattern allows adding new attack edges without modifying core graph logic, documented in CONTRIBUTING.md. The registry and builder are cleanly separated and could be adapted for any pluggable processing pipeline.