QCS Sensor Limitations

This topic describes potential challenges, limitations, and operational impacts of deploying Qualys Container Sensor across standalone and Kubernetes-based environments.

Common Considerations Across All Deployment Models

Evaluate the following before deployment:

• Resource consumption
• Initial discovery activity
• Dependency on connectivity to the Qualys Cloud Platform

Standalone Container Runtime Deployments

• Requires runtime socket access and shares host resources with application workloads.
• Large image repositories may increase processing time and resource utilization.

Kubernetes Deployments (All Runtimes)

• Uses a DaemonSet model.
• Requires Kubernetes API access and RBAC permissions.
• May generate additional API activity and synchronization during scaling events.

Kubernetes with Docker Runtime

• Depends on Docker socket access and correct storage-driver configuration.
• TLS-enabled Docker environments may require additional certificate configuration.

Kubernetes with Containerd Runtime

• Requires access to containerd socket and storage paths.
• Custom runtime paths must be reflected in the deployment YAML.

Kubernetes with CRI-O Runtime

Requires the CRI-O-specific deployment manifest and correct runtime path configuration.

OpenShift Deployments

Deployments may be affected by the following:

• SCC (Security Context Constraints) requirements
• hostPath restrictions
• Enterprise governance controls

Managed Kubernetes Services (AKS, EKS, GKE)

• Autoscaling events can trigger additional synchronization and discovery activities.
• Managed platform restrictions may require deployment adjustments.

Air-Gapped and Proxy Environments

Proper proxy and certificate configuration is required for cloud communication.

Performance Considerations for Large Environments

The following factors can increase synchronization times and resource usage:

• Large clusters
• High image churn
• Dense workloads

Unsupported or High-Risk Modifications

• RBAC permissions
• Runtime mounts
• Mandatory variables
• Required security settings

Best Practices

• Use runtime-specific YAMLs.
• Validate in non-production environments.
• Monitor resource usage.
• Maintain connectivity to the Qualys platform.