Skip to main content
Version: 9.0.9

References

Knowledge Base​

This knowledge base has How-To guides and troubleshooting articles related to Veeam Kasten.

Technical Previews​

Technology Preview features provide early access to upcoming product innovations, enabling you to test functionality and provide feedback during the development process. However, these features have limited support under Veeam Kasten Product Support, may not be functionally complete, and are not intended for production use.

Such features may require explicit opt-in by an administrator by enabling specific feature flag settings and will be documented on a per feature basis.

In addition to collecting feedback, Veeam Kasten support may create bug reports on behalf of support cases filed by Technology Preview customers. These bug reports will then be forwarded to Veeam Kasten Engineering as proposed for inclusion in a future release.

During the development of a Technology Preview feature, additional capabilities or components may become available for public testing. It is the intention of Veeam Kasten to fully support Technology Preview features in a future release, however, due to unforeseen circumstances some Technology Preview features may be removed from future releases and production support will not be made available. Additionally, not all Technology Preview features may provide a migration path from Technology Preview to a Generally Available (GA) release of the feature.

Kasten Best Practices​

Explore the following recommended practices for Veeam Kasten to optimize its performance and ensure effective data management of cloud-native applications. Refer to this page for more information.

Security​

Software Bill of Materials​

For the Veeam Kasten environment to be transparent, secure, and compliant, the Software Bill of Materials (SBOM) provides information about software components included in or with Veeam Kasten software.

The SBOM bundle, generated using Syft against all Veeam Kasten images, provides a machine-readable digest usable by other tools to perform vulnerability scanning and verify license compliance.

Download SBOM bundle: sboms-9.0.9.tar.gz

Note

Veeam Kasten repackages and distributes the following 3rd-party open-source images:

The published bill of materials for these 3rd-party images are incomplete. Please refer to their corresponding projects for additional information.

Vulnerability Exploitability eXchange (VEX)​

When a scanner reads an SBOM, it only sees module names and versions, reporting vulnerabilities whenever a module version is in the affected range, even if the vulnerable package is not compiled into the binary. OpenVEX documents record which Go vulnerabilities apply to each Veeam Kasten image, enabling scanners to filter false positives.

Note

The VEX document covers Go modules only. Findings in operating system packages, or in the JavaScript packages bundled in the frontend image, are not included.

Download VEX document: vex-9.0.9.openvex.json

The document is generated when the release is built, by running govulncheck against the linux/amd64 Go binaries in each image. It reflects the Go vulnerability database at that time; vulnerabilities published later are not listed. Each statement names the image and the release it applies to (pkg:generic/<image>@<version>, and the image digest as pkg:oci/<image>@<digest>), so a statement never covers another release.

Each statement has one of these statuses:

  • not_affected with justification vulnerable_code_not_present: the binary includes the module, but does not import the vulnerable package.
  • not_affected with justification vulnerable_code_not_in_execute_path: the binary imports the vulnerable package, but never calls the vulnerable function.
  • affected: a binary in the image calls the vulnerable code. Check the Veeam Kasten release notes for the release that fixes it.
  • under_investigation: used for findings in the dex, prometheus and configmap-reload images that govulncheck does not report as affected. Veeam Kasten does not make not_affected claims for these 3rd-party images. kanister-tools is built from Kanister, an open-source project that Veeam Kasten maintains, so the VEX document covers it in the same way as the other Veeam Kasten images.

The impact statement on each not_affected statement lists the binaries to which it applies.

Use the VEX Document with Grype​

Extract the SBOM bundle, then pass the VEX document to grype with --vex when scanning an image's SBOM: 

$ tar -xzf sboms-9.0.9.tar.gz
$ grype sbom:dashboardbff_9.0.9.spdx --vex vex-9.0.9.openvex.json

The same document also applies when scanning the image itself:

$ grype gcr.io/kasten-images/dashboardbff:9.0.9 --vex vex-9.0.9.openvex.json

grype moves vulnerabilities that the VEX document marks not_affected or fixed out of its results. To list them alongside the remaining results, add --show-suppressed (table output only).

Note

grype 0.68.0 and later apply not_affected and fixed statements automatically when passing --vex. For older grype releases, add these rules to the ignore section of the grype configuration file: 

ignore:
  - vex-status: not_affected
  - vex-status: fixed

Use the VEX Document with Trivy​

Pass the VEX document to Trivy with --vex when scanning an image: 

$ trivy image --vex vex-9.0.9.openvex.json gcr.io/kasten-images/dashboardbff:9.0.9

Add --show-suppressed to list the vulnerabilities that the VEX document suppressed.

Veeam Kasten Helm Chart Provenance​

The integrity and origin of Veeam Kasten Helm charts can be verified using Helm provenance. The Veeam Kasten Helm charts are signed with a GnuPG keypair. The public part of the keypair must be downloaded to verify the Helm chart.

Note

Helm chart provenance is supported only in Veeam Kasten chart versions 6.5.14 and later.

Download the Veeam Kasten Helm Chart Public Signing Key​

The Veeam Kasten Helm chart public signing key must be used to verify the provenance of the Veeam Kasten Helm charts. The official public signing key can be downloaded here.

Verify the Helm Chart Integrity​

The Veeam Kasten Helm chart integrity can be verified either by:

  • Downloading the chart and running the helm verify command.
  • Using the --verify option during chart installation.
Verify the Downloaded Helm Chart​

A downloaded Helm chart can be verified using the helm verify command.

To download a Helm chart, the helm pull command can be used as follows: 

$ helm pull --prov kasten/k10 --version=<k10-version>

Once the Helm chart has been downloaded, the helm verify command can be used to verify the integrity of the downloaded Helm chart. 

$ helm verify --keyring=/path/to/downloaded/RPM-KASTEN k10-<k10-version>.tgz --namespace kasten-io

Alternatively, the pull and verify commands can be combined as follows:

$ helm pull --prov kasten/k10 --version=<k10-version> --verify --keyring=/path/to/downloaded/RPM-KASTEN
Verify the Chart During Installation​

The Veeam Kasten Helm chart can be verified during installation using the --verify option with the helm install or helm upgrade command.

For example:

$ helm install k10 kasten/k10 --namespace=kasten-io --verify --keyring=/path/to/downloaded/RPM-KASTEN