Scopes and Inventory

Scopes and Inventory Overview

This section provides visibility of the scope hierarchy, along with all the inventory it contains. Scopes categorize the available inventory using a hierarchical structure. For more information, see Manage Inventory for Secure Workload.

From the navigation pane, choose Organize > Scopes and Inventory, traverse down your scope hierarchy. Each scope is displayed in a scope card. The scope card displays the following:

• Scope name

• Number of children scope

• Iventory count

• (optional) Uncategorized inventory

Click on a scope card to update the pane for displaying details about the scope and the filtered list of all its inventory.

Scope Design Principles

1. Match inventory to the scope tree according to a dynamic query match.

   • Match queries against IP or Subnet or Label (preferred)

   • Form a scope tree through conjunctive query at each layer.

2. Scope structure may be location specific-Combined Cloud vs Data Center and Cloud Specific vs Geographic location

3. Each layer of the scope tree should represent an anchor point for:

   • Policy control

   • Role Based Access Control (RBAC)

4. Keep the scope layer not too deep.

5. Ensure no overlapping of scopes:

   • Every child scope should be a subset of its parent scope.

   • Ensure nonoverlapping of sibling scopes, see Scope Overlap.

   Every organization is structured differently, and depending on your industry, it requires different approaches. Choose a focus area that helps in designing your scope hierarchy; location, environment, or application.

   Do not use IP address or subnet to define scopes that involve Kubernetes inventory. You must use labels to define scopes and policies for these workloads. IP address alone is not sufficient to identify pod services because defining scopes using IP addresses produces unreliable results.

6. If a host has multiple interfaces, we recommend keeping all IPs belonging to the host under a single scope, so that we can discover and enforce required policies from a single location.

7. Keep the overall scope numbers within the supported limit (see the limit section)

Key Features

Inventory count is displayed in the scopes card, providing a quick view into the number of workloads in the scope.

The filtering feature for both scopes and inventory helps to traverse down the scope tree or filter the scope hierarchy and inventory items of the selected scope.