mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-08-09 18:32:52 +00:00
feat: open security basics, manual fleet ops, and basic fleet management to Community (#930)
Realign tier guards to the user-stated philosophy: Community covers
deploy/monitor at scale plus security basics, Skipper adds automation
and advanced fleet management, Admiral keeps enterprise control.
Community now includes:
- Trivy install / uninstall / update from the Settings Hub (admin role)
- CVE suppressions CRUD (admin role; replicates fleet-wide)
- Manual image scan with vuln, secret, and misconfig results
- Stack-config scan, scan comparison
- Manual fleet snapshots: create, list, view, restore, delete
- Per-node Sencho self-update (Check Updates + per-node Update)
- Fleet Overview search, sort, filters, node-card expand, auto-refresh
Stays paid:
- Scan policies with block_on_deploy enforcement (Skipper+)
- SBOM (SPDX, CycloneDX), SARIF export (Skipper+)
- Bulk Update All across the fleet (Skipper+)
- Scheduled snapshot create (now Skipper, was Admiral)
- Trivy auto-update toggle, fleet-wide policy push (Admiral)
The Settings -> Security tab is unhidden by setting the registry tier to
null. The SecuritySection no longer early-returns a PaidGate; the policy
list, Add Policy button, and policy dialogs are wrapped in {isPaid && }.
The Fleet view drops isPaid gates on the Snapshots tab, Check Updates
button, per-node update handlers, OverviewToolbar grid controls, the
NodeCard expand affordance, and the auto-refresh notice. The
NodeUpdatesSheet receives a canBulkUpdate prop and gates the Update All
button on it. useFleetUpdateStatus and useFleetPolling drop their isPaid
guards so polling runs for Community; useFleetOverview drops the isPaid
wrap on the filter and sort path.
Backend route guards are flipped per the matrix above. The scheduler
tick and requireScheduledTaskTier add 'snapshot' to the Skipper+ branch.
Backend test assertions are inverted for the now-Community endpoints
and a positive Skipper-snapshot-task test is added.
Documentation across features/, api-reference/, and operations/ is
updated to reflect the new tier mapping.
This commit is contained in:
Anso
@@ -5,7 +5,7 @@ description: Automate scan policies, CVE suppressions, and vulnerability scans f
|
||||
|
||||
The Security API lets you manage scan policies, CVE suppressions, and trigger vulnerability scans from CI pipelines and automation scripts. Every endpoint in this reference is intended for external automation; internal frontend-only endpoints (finding listings, SARIF downloads) are not documented here.
|
||||
|
||||
All endpoints require [Bearer token authentication](/api-reference/overview#authentication) and most are gated to Skipper or Admiral. See the per-endpoint **License** row for details.
|
||||
All endpoints require [Bearer token authentication](/api-reference/overview#authentication). Manual scans, secret and misconfiguration results, scan comparison, and CVE suppressions are available on every tier. Scan policies (with `block_on_deploy` enforcement), SBOM, and SARIF stay on Skipper or Admiral. See the per-endpoint **License** row for details.
|
||||
|
||||
## Scan policies
|
||||
|
||||
@@ -120,7 +120,7 @@ Suppressions let you mark individual CVEs as acknowledged so scan reads, compari
|
||||
|
||||
**`GET /api/security/suppressions`**
|
||||
|
||||
**License:** Skipper or Admiral
|
||||
**License:** Community
|
||||
|
||||
Response rows include an `active` boolean computed from the `expires_at` timestamp.
|
||||
|
||||
@@ -145,7 +145,7 @@ Response rows include an `active` boolean computed from the `expires_at` timesta
|
||||
|
||||
**`POST /api/security/suppressions`**
|
||||
|
||||
**License:** Skipper or Admiral · **Role:** Admin
|
||||
**License:** Community · **Role:** Admin
|
||||
|
||||
| Field | Type | Required | Description |
|
||||
|-------|------|:--------:|-------------|
|
||||
@@ -176,7 +176,7 @@ curl -X POST https://your-sencho-instance:1852/api/security/suppressions \
|
||||
|
||||
**`DELETE /api/security/suppressions/{id}`**
|
||||
|
||||
**License:** Skipper or Admiral · **Role:** Admin
|
||||
**License:** Community · **Role:** Admin
|
||||
|
||||
```bash
|
||||
curl -X DELETE https://your-sencho-instance:1852/api/security/suppressions/3 \
|
||||
@@ -189,7 +189,7 @@ curl -X DELETE https://your-sencho-instance:1852/api/security/suppressions/3 \
|
||||
|
||||
**`POST /api/security/scan`**
|
||||
|
||||
**License:** Community for vulnerability-only scans. Skipper or Admiral when `scanners` includes `secret`. · **Role:** Admin
|
||||
**License:** Community · **Role:** Admin
|
||||
|
||||
Accepts an image reference and starts an asynchronous scan. The response returns immediately with a `scanId` that you can poll.
|
||||
|
||||
@@ -198,7 +198,7 @@ Accepts an image reference and starts an asynchronous scan. The response returns
|
||||
| `imageRef` | string | yes | Image reference Trivy will scan (must match Sencho's validator; `/`, `:`, `@`, alphanumerics, `-`, `_`, `.`). |
|
||||
| `stackName` | string | no | Associates the scan with a stack for display purposes. |
|
||||
| `force` | boolean | no | Default `false`. When `true`, ignores the 24-hour digest cache and runs Trivy again. |
|
||||
| `scanners` | `["vuln"]` or `["vuln","secret"]` | no | Omit for vuln-only. `secret` requires Skipper or Admiral. |
|
||||
| `scanners` | `["vuln"]` or `["vuln","secret"]` | no | Omit for vuln-only. Pass `["vuln","secret"]` to include secret detection. |
|
||||
|
||||
```bash
|
||||
curl -X POST https://your-sencho-instance:1852/api/security/scan \
|
||||
|
||||
@@ -6,7 +6,7 @@ description: "Accept known-benign vulnerabilities fleet-wide so your scan result
|
||||
Not every CVE that Trivy reports requires a response. Some are false positives on your base image, some have been accepted by your security review, and some are waiting on an upstream patch. CVE suppressions let you annotate these findings once so they stop competing for attention in every scan, comparison, and alert.
|
||||
|
||||
<Note>
|
||||
CVE suppressions require a **Skipper** or **Admiral** license.
|
||||
CVE suppressions are available on every tier. Suppressions written on a control node replicate to its replicas at fleet scope.
|
||||
</Note>
|
||||
|
||||
## What suppressions do
|
||||
|
||||
@@ -4,7 +4,7 @@ description: Snapshot compose files across all nodes for disaster recovery and a
|
||||
---
|
||||
|
||||
<Note>
|
||||
Fleet-Wide Backups require a Skipper or Admiral license. The feature is available to admins in the Fleet View.
|
||||
Manual fleet snapshots are available on every tier (admin role required). Scheduled fleet snapshots are a Skipper or Admiral feature.
|
||||
</Note>
|
||||
|
||||
Create point-in-time snapshots of every `compose.yaml` and `.env` file across your entire fleet, local and remote nodes alike. Snapshots are stored centrally in Sencho's database and can be browsed, previewed, and restored at any time.
|
||||
|
||||
@@ -84,10 +84,10 @@ Click the **Refresh** button in the top-right to re-fetch data from all nodes. T
|
||||
|
||||
---
|
||||
|
||||
## Paid features
|
||||
## Fleet operations
|
||||
|
||||
<Note>
|
||||
The features below require a Skipper or Admiral license. Community users see an upgrade prompt in place of these controls.
|
||||
The toolbar (search, sort, filters), stack drill-down, auto-refresh, and per-node update flow are available on every tier. The bulk **Update All** action inside the Node Updates modal is a Skipper or Admiral feature.
|
||||
</Note>
|
||||
|
||||
### Auto-refresh
|
||||
@@ -163,7 +163,7 @@ The modal shows:
|
||||
- **Filter** search box to find specific nodes
|
||||
- **Node table** with columns: Node name, Type, Current version, Latest version, and Status (either an "Up to date" badge or an "Update" button)
|
||||
- **Recheck** button to refresh the latest version from GitHub and re-scan for available updates
|
||||
- **Update All** button to trigger updates on all remote nodes that have a pending update
|
||||
- **Update All** button to trigger updates on all remote nodes that have a pending update (Skipper or Admiral)
|
||||
|
||||
When you click **Update** on a remote node, Sencho sends the update command to the remote instance. The remote pulls the latest Docker image, then spawns a short-lived helper container that performs the compose recreate. The node restarts with the new version, and the status badge transitions from "Updating" to "Updated" once the gateway detects the version change. The "Updated" badge remains visible for 60 seconds before the node returns to "Up to date".
|
||||
|
||||
|
||||
@@ -23,14 +23,19 @@ Lifetime pricing is an early-adopter offer available for a limited time only.
|
||||
|
||||
**Community** includes:
|
||||
- Unlimited nodes, compose editor, global logs, app store, alerts, and more
|
||||
- Fleet View with search, sort, filters, node-card expand, and topology
|
||||
- Manual fleet snapshots (create, browse, restore, delete)
|
||||
- Per-node Sencho updates and the Check Updates view
|
||||
- Vulnerability scanning: install/update/uninstall Trivy, on-demand scans (vulnerabilities, secrets, misconfigurations), scan comparison, and CVE suppressions
|
||||
- Two-factor authentication (TOTP)
|
||||
- Custom OIDC single sign-on (works with Authelia, Keycloak, Authentik, Zitadel, Pocket ID, or any spec-compliant OIDC identity provider)
|
||||
|
||||
**Skipper** includes everything in Community, plus:
|
||||
- Fleet View with drill-down
|
||||
- Webhooks and stack labels
|
||||
- Atomic deployments and fleet-wide backups
|
||||
- Auto-update policies
|
||||
- Atomic deployments
|
||||
- Bulk **Update All** across the fleet, scheduled scans, scheduled updates, and scheduled fleet snapshots
|
||||
- Scan policies with `block_on_deploy` enforcement, SBOM (SPDX, CycloneDX), and SARIF export
|
||||
- Auto-update policies for stack images
|
||||
- One-click Google, GitHub, and Okta SSO presets
|
||||
|
||||
**Admiral** includes everything in Skipper, plus:
|
||||
@@ -40,7 +45,8 @@ Lifetime pricing is an early-adopter offer available for a limited time only.
|
||||
- Audit log and host console
|
||||
- API tokens and private registries
|
||||
- Notification routing
|
||||
- Scheduled operations
|
||||
- Auto-update of the managed Trivy binary
|
||||
- All other scheduled operations (restart, prune, etc.)
|
||||
|
||||
<Tip>
|
||||
**SSO is available on every tier.** Community users can integrate any OIDC-compliant identity provider through the Custom OIDC option. Paid tiers add turnkey presets (Google, GitHub, Okta) and LDAP / Active Directory.
|
||||
|
||||
@@ -57,7 +57,7 @@ Monitor your entire infrastructure from a single screen. The fleet dashboard sho
|
||||
|
||||
## Remote updates
|
||||
|
||||
Check for outdated nodes and trigger over-the-air updates from the Fleet View. When the gateway is running a newer version than a remote node, a one-click update pulls the latest image and recreates the container automatically. [Learn more →](/features/remote-updates)
|
||||
Check for outdated nodes and trigger over-the-air updates from the Fleet View. When the gateway is running a newer version than a remote node, a one-click update pulls the latest image and recreates the container automatically. Per-node updates and the Check Updates view are available on every tier; the bulk **Update All** action is Skipper or Admiral. [Learn more →](/features/remote-updates)
|
||||
|
||||
## Alerts & notifications
|
||||
|
||||
@@ -81,7 +81,7 @@ Define schedules for Sencho to automatically check your container images for upd
|
||||
|
||||
## Scheduled operations
|
||||
|
||||
Automate recurring maintenance tasks like stack restarts, fleet snapshots, and system prunes on a cron schedule. Every execution is logged with full history so you always know what ran and when. Admiral only. [Learn more →](/features/scheduled-operations)
|
||||
Automate recurring maintenance tasks like stack restarts, fleet snapshots, and system prunes on a cron schedule. Every execution is logged with full history so you always know what ran and when. Scheduled scans, updates, and snapshots are available on Skipper and Admiral; other scheduled actions remain Admiral only. [Learn more →](/features/scheduled-operations)
|
||||
|
||||
## RBAC & user management
|
||||
|
||||
@@ -97,7 +97,7 @@ Skipper and Admiral users get automatic backup and rollback on every deployment.
|
||||
|
||||
## Fleet-wide backups
|
||||
|
||||
Create point-in-time snapshots of every compose file and environment file across all nodes. Snapshots are stored centrally and can be browsed by node and stack. Restore individual stacks from any snapshot with optional one-click redeploy, even to remote nodes. [Learn more →](/features/fleet-backups)
|
||||
Create point-in-time snapshots of every compose file and environment file across all nodes. Snapshots are stored centrally and can be browsed by node and stack. Restore individual stacks from any snapshot with optional one-click redeploy, even to remote nodes. Manual snapshots are available on every tier; scheduled fleet snapshots are Skipper or Admiral. [Learn more →](/features/fleet-backups)
|
||||
|
||||
## Private registries
|
||||
|
||||
@@ -105,7 +105,7 @@ Store credentials for private Docker registries: Docker Hub organizations, GHCR,
|
||||
|
||||
## Vulnerability scanning
|
||||
|
||||
Scan container images for known CVEs with [Trivy](https://trivy.dev). On-demand scanning and severity badges are available on every tier; scheduled scans, scan policies that gate deploys, SBOM generation, and scan history are available on Skipper and Admiral. [Learn more →](/features/vulnerability-scanning)
|
||||
Scan container images for known CVEs with [Trivy](https://trivy.dev). Manual scanning, secret and misconfiguration detection, scan comparison, and CVE suppressions are available on every tier; scheduled scans, scan policies that gate deploys, SBOM generation, and SARIF export are available on Skipper and Admiral. Auto-update of the managed Trivy binary is Admiral. [Learn more →](/features/vulnerability-scanning)
|
||||
|
||||
## Audit log
|
||||
|
||||
|
||||
@@ -6,7 +6,7 @@ description: Check for outdated nodes and trigger over-the-air Sencho updates fr
|
||||
Sencho can update remote nodes directly from the dashboard. When a node is running an older version than the latest available release, a one-click update pulls the latest image and recreates the container automatically. This includes the local (gateway) node itself.
|
||||
|
||||
<Note>
|
||||
Remote updates require a **Skipper** or **Admiral** license.
|
||||
Per-node remote updates and the Check Updates view are available on every tier (admin role required). The bulk **Update All** action is a Skipper or Admiral feature.
|
||||
</Note>
|
||||
|
||||
## Prerequisites
|
||||
|
||||
@@ -4,7 +4,7 @@ description: Automate recurring Docker operations like stack restarts, lifecycle
|
||||
---
|
||||
|
||||
<Note>
|
||||
Scheduled Operations requires a Sencho **Admiral** license. Skipper users see only the **Auto-update Stack** action; Admiral users see every action.
|
||||
Scheduled Operations is available to admins on Skipper and Admiral. Skipper unlocks **Auto-update Stack**, **Vulnerability Scan**, and **Fleet Snapshot**. All other actions (Restart Stack, System Prune, Backup Stack Files, Stop / Take Down / Start Stack) remain Admiral.
|
||||
</Note>
|
||||
|
||||
## Overview
|
||||
@@ -36,7 +36,7 @@ Toggle to **All tasks** from the header to see every schedule in a table, regard
|
||||
|--------|--------|-------------|
|
||||
| **Restart Stack** | A specific stack (or specific services within it) on a specific node | Restarts all or selected containers in the stack |
|
||||
| **Auto-update Stack** | A specific stack on a specific node | Checks each image for updates and recreates the stack if any image has a newer version. See [Auto-Update Readiness](/features/auto-update-policies) for the companion board. Available on Skipper and Admiral. |
|
||||
| **Fleet Snapshot** | All nodes | Creates a fleet-wide backup of all compose files and `.env` files |
|
||||
| **Fleet Snapshot** | All nodes | Creates a fleet-wide backup of all compose files and `.env` files. Available on Skipper and Admiral. |
|
||||
| **System Prune** | The default node | Prunes selected resources, optionally filtered by Docker label |
|
||||
| **Vulnerability Scan** | All images on a specific node | Runs Trivy against every image on the target node and records the results. Requires Trivy to be installed, see [Installing Trivy](/operations/trivy-setup). Available on Skipper and Admiral. |
|
||||
| **Backup Stack Files** | A specific stack on a specific node | Backs up the stack's compose file and `.env` to `<DATA_DIR>/backups/<stackName>/`. The most recent backup per stack is kept; each run overwrites the previous one. |
|
||||
@@ -46,7 +46,7 @@ Toggle to **All tasks** from the header to see every schedule in a table, regard
|
||||
|
||||
## Creating a Scheduled Task
|
||||
|
||||
1. Navigate to the **Schedules** tab in the top navigation bar (visible to Admiral admins).
|
||||
1. Navigate to the **Schedules** tab in the top navigation bar (visible to Skipper and Admiral admins).
|
||||
2. Click **New Schedule**.
|
||||
3. Fill in the form:
|
||||
- **Name**: A descriptive label (e.g. "Nightly staging restart").
|
||||
@@ -212,7 +212,7 @@ Execution history is retained for 30 days.
|
||||
|
||||
The Scheduler Service runs in the background and checks for due tasks every 60 seconds. When a task's next run time has passed:
|
||||
|
||||
1. The scheduler verifies your Admiral license is active.
|
||||
1. The scheduler verifies your license tier matches the action (Skipper for update, scan, snapshot; Admiral for everything else).
|
||||
2. It executes the configured action using the same internal services that power the UI buttons (restart, snapshot, prune).
|
||||
3. Results are logged to the execution history.
|
||||
4. On failure, an alert is dispatched via your configured notification channels.
|
||||
|
||||
@@ -3,7 +3,7 @@ title: "Vulnerability Scanning"
|
||||
description: "Scan container images for known CVEs, surface severity badges in the Resources Hub, and alert on policy violations."
|
||||
---
|
||||
|
||||
Sencho integrates with [Trivy](https://trivy.dev) to scan container images for known vulnerabilities (CVEs), surface severity badges next to your images, and alert when a scan result exceeds a configured threshold. On-demand scanning is available on every tier; automation, policies, and SBOM generation are Skipper and Admiral.
|
||||
Sencho integrates with [Trivy](https://trivy.dev) to scan container images for known vulnerabilities (CVEs), surface severity badges next to your images, and alert when a scan result exceeds a configured threshold. Manual scanning, secret and misconfiguration detection, scan comparison, and CVE suppressions are all available on every tier. Skipper and Admiral add automation, policy enforcement, and compliance exports.
|
||||
|
||||
<Frame>
|
||||
<img src="/images/vulnerability-scanning/resources-badges.png" alt="Resources Hub showing vulnerability severity badges next to image tags" />
|
||||
@@ -21,17 +21,20 @@ The Trivy CLI must be available on the machine running Sencho. Trivy is not bund
|
||||
|
||||
| Feature | Community | Skipper | Admiral |
|
||||
|---------|:---------:|:-------:|:-------:|
|
||||
| On-demand image scanning | ✓ | ✓ | ✓ |
|
||||
| Install / update / uninstall Trivy from Settings | ✓ | ✓ | ✓ |
|
||||
| On-demand image scanning (vulnerabilities) | ✓ | ✓ | ✓ |
|
||||
| Severity badges in the Resources Hub | ✓ | ✓ | ✓ |
|
||||
| Scan results drawer with vulnerability table | ✓ | ✓ | ✓ |
|
||||
| Post-deploy automated scanning | ✓ | ✓ | ✓ |
|
||||
| Secret detection in image filesystems | ✓ | ✓ | ✓ |
|
||||
| Compose file misconfiguration scanning | ✓ | ✓ | ✓ |
|
||||
| Scan history and comparison | ✓ | ✓ | ✓ |
|
||||
| CVE suppressions | ✓ | ✓ | ✓ |
|
||||
| Scheduled fleet scans (all images on a node) | | ✓ | ✓ |
|
||||
| Scan policies (warning and critical alerts) | | ✓ | ✓ |
|
||||
| Scan policies with `block_on_deploy` enforcement | | ✓ | ✓ |
|
||||
| SBOM generation (SPDX, CycloneDX) | | ✓ | ✓ |
|
||||
| Scan history and comparison | | ✓ | ✓ |
|
||||
| Secret detection in image filesystems | | ✓ | ✓ |
|
||||
| Compose file misconfiguration scanning | | ✓ | ✓ |
|
||||
| SARIF export (code scanning integration) | | ✓ | ✓ |
|
||||
| Auto-update of the managed Trivy binary | | | ✓ |
|
||||
|
||||
## On-demand scanning
|
||||
|
||||
|
||||
@@ -44,7 +44,7 @@ When a newer Trivy release is available, Settings → Security shows an **Update
|
||||
|
||||
To update automatically instead, toggle **Auto-update Trivy** on. Sencho checks for new releases once a day and installs them in the background. You'll get an in-app notification each time a new version is installed, or when an update is available and auto-update is off.
|
||||
|
||||
The install, update, and uninstall buttons are Admiral-only. Skipper and Community instances see the scanner status, but install actions require an Admiral license.
|
||||
The install, update, and uninstall buttons are available to admins on every tier. The **Auto-update Trivy** toggle is Admiral only.
|
||||
|
||||
### Removing the managed install
|
||||
|
||||
@@ -212,11 +212,9 @@ This means the host binary is not ABI-compatible with the Sencho image. Use the
|
||||
|
||||
The first scan after a Trivy install downloads the vulnerability database. Expect 10 to 30 seconds of additional latency. Subsequent scans are near-instant once the cache is warm and `TRIVY_CACHE_DIR` is persisted.
|
||||
|
||||
### Install button is disabled
|
||||
### Install button is hidden
|
||||
|
||||
The install, update, and uninstall buttons require an Admiral license. If you hold a Skipper or Community license, the card shows current status only; use Option 2 or 3 to add Trivy manually.
|
||||
|
||||
The install button is also hidden when a host-installed Trivy is already detected on `PATH`. Remove the host binary (or drop the bind mount) to switch to the managed install.
|
||||
The install button is hidden when a host-installed Trivy is already detected on `PATH`. Remove the host binary (or drop the bind mount) to switch to the managed install. The button also requires the admin role; viewer accounts see the scanner status only.
|
||||
|
||||
### Private registry images fail to scan
|
||||
|
||||
|
||||
Reference in New Issue
Block a user