fix: make SBOM failure service discovery opt-in

[ANAMASGARD]

Overview

Prevent node-agent from performing remote service discovery for SBOM failure reporting unless it is explicitly enabled.

This adds the default-disabled sbomFailureReportingEnabled configuration option. Service discovery now runs only when both:

• sbomGenerationEnabled is true
• sbomFailureReportingEnabled is true

When enabled, the existing discovery behavior is preserved:

1. Use SERVICES or /etc/config/services.json when available.
2. Otherwise use API_URL.
3. Fall back to api.armosec.io when API_URL is unset.

Setting API_URL or mounting services.json alone does not enable failure reporting. Discovery errors and empty receiver URLs remain
non-fatal.

Additional Information

This changes SBOM failure reporting from implicit behavior to explicit opt-in behavior. Existing deployments that require failure reporting must add:

{
  "sbomGenerationEnabled": true,
  "sbomFailureReportingEnabled": true
}

How to Test

Focused tests:

  go test -count=1 ./pkg/config ./cmd
  go test ./pkg/sbommanager/v1

These checks pass locally.

A serial non-e2e repository test sweep was also performed. The remaining unrelated environment-dependent failures were:

• Tracer field tests require a generated root-level tracers.tar.
• pkg/validator requires permission to raise the memlock limit.

Socket-dependent exporter, node-profile, and SBOM-scanner tests passed when run outside the restricted sandbox.

Related issues/PRs

• Resolves Avoid remote service discovery by default #899

Checklist before requesting a review

• My code follows the style guidelines of this project
• I have commented on my code where necessary
• I have performed a self-review of my code
• I have added thorough regression tests
• Focused unit tests pass locally with my changes

Summary by CodeRabbit

• New Features

  • Added an opt-in setting for reporting SBOM generation failures.
  • SBOM failure reporting remains disabled by default and is activated only when both SBOM generation and failure reporting are enabled.
  • Failure report destinations can be resolved from local service configuration or the configured API endpoint.

• Documentation

  • Documented the new configuration option, activation requirements, and service discovery behavior.
  • Added a link to the Kubescape documentation.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 63484d00-ab44-4d1a-b8b3-532c8075e2b2

📥 Commits

Reviewing files that changed from the base of the PR and between 4956ea2 and 66cf8eb.

📒 Files selected for processing (6)

• README.md
• cmd/main.go
• cmd/main_test.go
• docs/CONFIGURATION.md
• pkg/config/config.go
• pkg/config/config_test.go

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The change adds an opt-in sbomFailureReportingEnabled configuration flag. SBOM failure receiver discovery now runs only when SBOM generation and failure reporting are enabled, with tests and documentation covering the behavior.

Changes

SBOM failure reporting

Layer / File(s)	Summary
SBOM failure reporting configuration pkg/config/config.go, pkg/config/config_test.go	Adds EnableSbomFailureReporting, defaults it to false, and tests configuration loading.
Guarded receiver resolution cmd/main.go, cmd/main_test.go	Adds receiver URL resolution with guarded service discovery. The HTTP failure reporter is created only when a non-empty receiver URL is resolved.
Configuration documentation README.md, docs/CONFIGURATION.md	Documents the opt-in toggle, service discovery conditions, and default API URL behavior.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 66cf8

SBOM failure reporting is now explicitly opt-in, preventing service discovery unless both SBOM generation and failure reporting are enabled. The documented configuration behavior and guarded receiver handling are covered without an identified merge-blocking risk.

Sequence Diagram(s)

sequenceDiagram
  participant Main
  participant resolveSbomFailureReportReceiverURL
  participant LoadServiceURLs
  participant HTTPFailureReporter
  Main->>resolveSbomFailureReportReceiverURL: Resolve receiver URL
  resolveSbomFailureReportReceiverURL->>LoadServiceURLs: Load services when both toggles are enabled
  LoadServiceURLs-->>resolveSbomFailureReportReceiverURL: Return services or error
  resolveSbomFailureReportReceiverURL-->>Main: Return URL or empty string
  Main->>HTTPFailureReporter: Create reporter when URL is non-empty

Loading

Suggested reviewers: matthyx

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 4 files. (2 skipped: 2 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The changes satisfy issue #899. The new option defaults to false, and service discovery does not run unless both SBOM generation and SBOM failure reporting are enabled. Enabled discovery retains the r…
Out of Scope Changes check	✅ Passed	The code, configuration, tests, README, and documentation changes support the opt-in service discovery objective. No unrelated implementation changes are evident.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: SBOM failure service discovery is now opt-in.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 4 files. (2 skipped: 2 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}