Qualys Cloud Platform 1.33 (CS) API Notification 1

Whats New
Kubernetes Admission Controller
Centralized Policies for Kubernetes Admission Controller
CRS 1.0 Deprecation
Asset Tagging
Active Images

A new release of Qualys Cloud Platform 1.33 (CS) includes updated APIs which is targeted for release in May 2024. The specific day will differ depending on the platform. See platform release dates on the Qualys Status page. This API notification provides an early preview into the upcoming APIs, allowing you to identify use cases that can leverage these updated APIs.

What’s New

This release introduces new APIs for Kubernetes Clusters and Admission Controllers, allowing you to manage Clusters and Admission Controllers, view details, and update settings efficiently. Additionally, relevant APIs are updated to support centralized policies for Kubernetes Admission Controllers, enabling the creation and assignment of policies for enhanced control. CRS 1.0 is deprecated in this release, with associated APIs and documentation being phased out. Along with these, we have introduced new APIs to tag your Container Security assets.

Kubernetes Admission Controller

In this release, we have introduced new APIs to effectively work with your Kubernetes Clusters and Admission Controllers.

New API: Show a list of Kubernetes Clusters

GET /csapi/v1.3/k8sClusters

This API shows you a list of Kubernetes Clusters in your account.

New API: Show Details of a Kubernetes Cluster

GET /csapi/v1.3/k8sClusters/{clusterUid}

This API helps you see the details of the specified cluster.

New API: Update the Registry UUID of a Kubernetes Cluster

PUT /csapi/v1.3/k8sClusters/{clusterUid}

With this API, you can update the registry details of the specified k8s cluster.

New API: Show Details of a Kubernetes Admission Controller

GET /csapi/v1.3/k8sAdmissionControllers/{uuid}

This API shows you k8s Admission controller details of the specified uuid.

New API: Update Enforcement Action of a Kubernetes Admission Controller

PUT /csapi/v1.3/k8sAdmissionController/{uuid}

With this API, you can validate your action against the policies specified in the Admission Controller. You can update the enforcementAction parameter of the specified k8s admission controller to either allow your action to be passed, irrespective of the assigned policy, or you can validate the action against the assigned policy and based on that either allow or deny your action.

Centralized Policies for Kubernetes Admission Controller

With this release, you can now create and assign Centralized policy to your K8s Admission Controller. The following APIs are updated with this release.

Create a Centralized Policy

POST /csapi/v1.3/centralizedPolicy

With this release, a new policy type called K8S_Admission_Controller is introduced along with k8sFilters in the request to provide cluster and namespace details.

Show a list of Centralized Policies

GET /csapi/v1.3/centralizedPolicy

This API provides a list of all centralized policies present in your account. With this release, you can also see Kubernetes Admission Controller policies. You will see a new policyType called K8S_ADMISSION_CONTROLLER.

Show Details of a Centralized Policy

GET /csapi/v1.3/centralizedPolicy/{policyId}

With this release, a new policy type called K8S_Admission_Controller is introduced along with k8sFilters in the response to provide cluster and namespace details.

Delete a Centralized Policy

DELETE /csapi/v1.3/centralizedPolicy/{policyId}

With this API, now you can delete a Kubernetes Admission Controller type policies as well.

Update a Centralized Policy

PUT /csapi/v1.3/centralizedPolicy/{policyId}

With this API, you can mark a policy as Active or Inactive. You need to provide k8sFilters parameter in the request.

Show Details of the Default Centralized Policy

GET /csapi/v1.3/centralizedPolicy/defaultPolicy/{policyType}

This API shows details of the default centralized policy. It will now also support policies of K8S_ADMISSION_CONTROLLER type.

Update the Policy Mode of a Centralized Policy

PUT /csapi/v1.3/centralizedPolicy/{policyId}/mode

With this API, you can mark a Kubernetes Admission Controller policy as Active or Inactive.

CRS 1.0 Deprecation

With this release, Container Runtime Security (CRS) 1.0 is getting deprecated. Please refer to the CRS 1.0 End of Life Notification for more details.

This deprecation will also result in its associated CRS APIs getting deprecated. The following entities are getting deprecated along with this release.

CRS API Gateway (Already Deprecated) https://gateway.p04.eng.sjc01.qualys.com/apidocs/csapi/v1.3/runtime#/
CRS User Guide https://cdn2.qualys.com/docs/qualys-container-runtime-security-user-guide.pdf
CRS API Guide Qualys Container Runtime Security APIs https://docs.qualys.com/en/cs/crs-api/#t=Get_Started%2Fget_started.htm

Asset Tagging

With this release, you can assign and manage static tags of an asset (image, container). With the help of these static tags, you can categorize and organize your images and containers. The following APIs are introduced with this release.

New API: Assign Tags to an Asset

POST /csapi/v1.3/tag/assign

This API allows you to assign one or more tags to an image or a container.

New API: Assign Multiple Tags to Multiple Assets

POST /csapi/v1.3/tag/assign/bulk

This API allows you to assign one or more tags to multiple images or containers.

New API: Remove Tags Assigned to Assets

POST /csapi/v1.3/tag/remove

This API is used to remove one or more tags from an asset.

New API: Validate Asset Tags

POST /csapi/v1.3/tag/exist

This API is used to validate an asset tag.

Active Images

With this update, you can view the most recent update time of the images within your cluster. This enhancement is aimed at assisting you in prioritizing which images require vulnerability fixes. We have introduced a new input parameter named imageInUse in the APIs listed below. This parameter allows you to retrieve the images utilized within a specified timeframe. Additionally, the response now includes a lastUsedDate parameter, indicating the latest time the specified image was used.

Updated API: Fetch a List of Images in Your Account

GET /csapi/v1.3/images

Updated API: Fetch a List of Images (Bulk API)

GET /csapi/v1.3/images/list

Updated API: Fetch Image Details

GET /csapi/v1.3/images/{imageSha}

Please refer the detailed release note here: https://cdn2.qualys.com/docs/release-notes/qualys-container-security-1.33-api-release-notes.pdf