Release Notification: Container Security General Sensor Not Supported with the GCFS Storage Driver on GKE Version 1.35 and Later
Overview
This notification addresses a deployment limitation affecting the Qualys Container Security General Sensor on Google Kubernetes Engine (GKE) clusters running version 1.35. The Qualys Container Security General Sensor does not deploy on GKE version 1.35 and later when the GCFS (image streaming) storage driver is used. The sensor is supported only with the GCFS storage driver on GKE versions 1.34 and earlier.
Affected Environments
- GKE clusters running version 1.35 and higher.
- Applies only when the Container Security General Sensor is deployed with the GCFS storage driver.
Issue Description
During validation of the GKE GCFS driver, we observed that the Container Security General Sensor is not deployed on GKE versions 1.35 and later. This is because GKE internally removed the “/run/gcfsd/mnt/layers” path in GKE version 1.35 and later, which the sensor uses for the overlay mount.
Impact
- The Container Security General Sensor fails to deploy on GKE 1.35 and later when the GCFS storage driver is used.
- Container discovery and scanning are unavailable on affected nodes until a supported configuration is used.
Support Statement
When deployed with the GCFS storage driver, the Container Security General Sensor is supported only on GKE version 1.34 and earlier.
Planned Fix
We are actively working to restore compatibility with the GCFS storage driver on GKE version 1.35 and later in an upcoming sensor release. This notification will be updated once the fix is available.
Recommended Action
- If you are using the GCFS storage driver, deploy the Container Security General Sensor only on GKE version 1.34 and earlier.
- For GKE version 1.35 and later, deploy the sensor on node pools that do not use the GCFS storage driver.
- If you have questions, please contact your TAM or Qualys Technical Support.